Senior Cybersecurity Engineer, Platform Security; R5219

Shield AI is a venture-backed defense-tech company with the mission of protecting service members and civilians with intelligent systems. Its products include Hivemind autonomy software, V-BAT and X-BAT aircraft, and Aechelon simulation and synthetic reality technologies. With offices and facilities across the U.S., Europe, the Middle East, and Asia-Pacific, Shield AI’s technology actively supports operations worldwide. For more information, visit Follow Shield AI on Linked In, X, Instagram, and You Tube.

You’ll be the senior technical owner for paved roads and secure-by-default engineering on the Security Engineering team. Your job is not to review and say no - it is to engineer the secure defaults, golden paths, and guardrails-as-code that make the secure way to build the easy way to build, across cloud, infrastructure, and CI/CD.

You will design, build, and operate the IaC modules, pipeline templates, internal libraries, and policy-as-code controls that the rest of the company consumes. You will engineer guardrails that block or flag the insecure path automatically, and replace recurring manual security work with durable mechanisms that don’t depend on anyone remembering to do the right thing. As one of the most senior engineers on the team, you’ll help shape and drive the technical direction for how secure-by-default works at Shield AI - partnering closely with a hands‑on engineering lead - and raise the bar for everyone building on top of it.

This is a hands‑on, build‑heavy role. We are credible because we are technical - you’ll read the code, the configs, the telemetry, and the architecture, and ship solutions durable enough to run without you.

• Build the secure defaults:
  Infrastructure-as-Code modules, CI/CD pipeline templates, internal libraries, and golden-path scaffolding that make the secure choice the easy choice.
• Engineer guardrails as code - policy-as-code (OPA/Conftest), admission controllers, cloud guardrails (SCPs / org policy), and pre-commit and CI checks - so the insecure path is blocked or flagged automatically.
• Own the platform security tooling that other teams consume, so they don’t have to build their own; replace recurring manual work with durable, self-service mechanisms.
• Embed security into the software and infrastructure supply chain: pipeline security, build/artifact integrity, dependency and container scanning, and secrets management.
• Engineer workload and service identity controls (least privilege, short-lived credentials, federated trust) so zero-standing-privilege is real and observable.
• Write and maintain production-quality code and infrastructure that backs these controls.
• Partner with platform, infrastructure, and product engineering teams early - review high-blast-radius designs against the internal Security Engineering standard while the design can still change, and turn recurring findings into a missing paved road, not just another fix.
• Set technical direction and standards for secure-by-default; document them so they can be applied without us, and mentor and raise the bar for other engineers.

• Extensive experience in security engineering, platform/infrastructure engineering, Dev Sec Ops , or a closely related field, with a track record of owning complex systems end-to-end.
• Strong software engineering ability - you write, review, and ship production-quality code (any modern language) and treat infrastructure as software.
• Hands‑on experience building secure‑by‑default mechanisms:
  Infrastructure-as-Code, CI/CD pipeline security, and policy/guardrails as code.
• Deep working knowledge of at least one major cloud provider and its security and identity model.
• Demonstrated ability to design durable, automated…