Job Description
This is a hands-on, senior individual contributor role focused on designing, building, and operating cryptographic and infrastructure foundations. The core technology focus includes AWS CloudHSM, Terraform/Terragrunt, and JFrog Artifactory.
Key Responsibilities
- Design, build, and operate secure cryptographic and infrastructure foundations across AWS environments.
- Administer and support AWS CloudHSM in production, including cluster configuration, key management, high availability, backup/recovery, and operational troubleshooting.
- Develop and maintain reusable Terraform/Terragrunt modules following DRY principles and enterprise infrastructure standards.
- Govern Terraform remote state, environment separation, dependency management, and multi-account/multi-region infrastructure deployments.
- Design and implement secure AWS infrastructure using VPC, IAM, KMS, EKS, Route 53, and related services.
- Manage and support production Kubernetes/EKS environments with a strong focus on security, reliability, and scalability.
- Administer JFrog Artifactory for enterprise artifact management, governance, access control, signed builds, and CI/CD integration.
- Integrate security controls into CI/CD and GitOps pipelines, ensuring secure and automated software delivery.
Desired Experience & Qualification
Key Qualifications:
- 7+ years of experience in DevSecOps, Platform Engineering, or SRE with a strong security focus.
- Hands-on production experience with AWS CloudHSM (highly desirable).
- Advanced proficiency in Terraform and Terragrunt (DRY module composition, remote-state governance, multi-environment setups).
- Experience with JFrog Artifactory (enterprise artifact governance, signed builds, CI/CD integration).
- Strong AWS expertise (VPC, IAM, KMS, EKS, Route 53) and production Kubernetes/EKS.
- Familiarity with Zero Trust principles, service mesh, cloud networking, and GitOps/CI/CD pipelines.
Preferred Skills:
- Cryptographic delegation flows (OAuth 2.0 token exchange, workload identity federation).
- Agentic security patterns and Policy-as-Code (OPA/Sentinel).
- AWS or Kubernetes certifications (CKA, CKAD, CKS).