Infrastructure Security Engineer
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. The posting includes "About Us", "Position Overview", "Core Responsibilities", "Key Qualifications", "Preferred Qualifications", "Special Work Conditions", "Benefits", "Compensation". We need to map to allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We can choose sections that have real content.
We have "About Us" which is about company; could map to "About the role"? Actually "About the role" is more about role description. "Position Overview" could be "About the role". We'll use About the role
with content from Position Overview.
Responsibilities: from Core Responsibilities (multiple subparts). We'll list as - each bullet? The content is paragraphs; we can break into list items for each major responsibility area: Bug Bounty Program, Vulnerability Scanning and Findings Triage, CSPM, Agentic Red Team..., Security Tooling Evaluation and Adoption, Network and Perimeter Security. We'll include each as
- with description.
Requirements: maybe combine Key Qualifications and Preferred Qualifications? The instruction: Use headings for Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We have Key Qualifications (required) and Preferred Qualifications (preferred). We could put Key Qualifications under
Requirements
and Preferred Qualifications under Qualifications
or Skills. But we need to avoid thin sections. We'll put Requirements = Key Qualifications. Qualifications = Preferred Qualifications. Skills maybe not needed if covered. Benefits: we have benefits paragraph. Pay: we have compensation range. Schedule: not mentioned; we should not create Schedule section if no content. So omit Schedule.
We must not include boilerplate like EEO, CA residents, etc. Remove those.
We must preserve all substantive information; do not invent or summarize away detail. So we need to keep details from each section.
We need to output only HTML fragment, no /, no markdown fences.
Let's craft.
Structure:
About the role
Position Overview content...
Responsibilities
- Bug Bounty Program: Oversee day-to-day operation... (include all details)
- Vulnerability Scanning and Findings Triage: Manage and operate enterprise vulnerability scanners...
- Cloud Security Posture Management (CSPM): Manage and operate the CSPM platform...
- Agentic Red Team and Continuous Penetration Testing Platform: Manage and operate the agentic red-team pentesting platform...
- Security Tooling Evaluation and Adoption: Research, pilot, and benchmark emerging security products...
- Network and Perimeter Security: Support enterprise network security infrastructure...
Requirements
- 5+ years of experience in infrastructure, network, or cloud security roles.
- Experience running or supporting an enterprise vulnerability management program end-to-end...
- Demonstrated ability to triage security findings...
- Deep, practical understanding of common vulnerability classes...
- Hands-on proficiency with security testing tooling, including Burp Suite and Postman...
- Working coding ability, primarily Python and shell scripting...
- Hands-on experience securing at least one major cloud platform (AWS, Azure, or GCP)...
- Solid understanding of network protocols (TCP/IP, DNS, TLS) and perimeter security technologies.
- Familiarity with security frameworks and standards (NIST CSF, CIS Benchmarks, ISO 27001)...
- Strong written and verbal communication skills...
- Demonstrated curiosity and speed of learning...
- Interest in applying emerging AI capabilities to security operations...
Qualifications
- Experience operating or triaging a public or private bug bounty program on a platform such as HackerOne, Bugcrowd, or Intigriti.
- Offensive security experience: penetration testing, exploit validation, or red-team operations...
- Experience with infrastructure-as-code security (Terraform, CloudFormation) and shift-left security practices.
- Experience securing containerized workloads, including image hardening, registry security, runtime protection, and familiarity with orchestration platforms such as Kubernetes or ECS.
- Experience developing security automation or internal tooling beyond scripting, including work with security platform APIs and CI/CD integrations.
- Exposure to SIEM/SOAR platforms and security telemetry pipelines.
- Familiarity with zero trust network architecture (ZTNA) and micro-segmentation.
- Relevant certifications: AWS Security Specialty, CCSP, CISSP, OSCP, CompTIA Security+, or equivalent.
Benefits
We take care of our people. When you join Cast & Crew, you're backed by a benefits package built around what matters most. From comprehensive medical, dental, and vision coverage, to a 401(k) match, generous PTO, paid parental leave, health and wellness programs, tuition reimbursement, and employee discounts. We’re committed to helping you thrive, professionally, and personally. Benefits Are Subject To Eligibility Requirements.
Pay
The compensation range for this position is: $150,000.00 - $170,000.00 per year.
We need to ensure we didn't include any boilerplate like "Special Work Conditions", "EEO", etc. We omitted Special Work Conditions. Good.
Check that we didn't repeat job title. No.
Check that we didn't include any placeholder like "commensurate with experience". We omitted that line.
Check that we preserved all substantive information: Did we miss any details from Position Overview? Let's capture it fully.
Position Overview text: "We are looking for an Infrastructure Security Engineer to run the operational core of our offensive and vulnerability management programs. You will own the tooling that continuously tests our environment — bug bounty, agentic red team, CSPM, and vulnerability scanners — turn the output of those platforms into a prioritized, de-duplicated set of real issues, and drive them to verified closure with engineering and infrastructure teams. This is a hands-on, highly cross-functional role for someone who is as comfortable validating an exploit as they are chasing a fix to completion. We are also looking for someone who is genuinely curious and learns fast. Our security stack changes quickly, and a meaningful part of this role is exploring, testing, and deploying emerging security products — including tooling built on the latest AI capabilities — evaluating whether they actually work in our environment, and putting the ones that do into production."
We need to include that in under About the role.
Now Responsibilities: we need to include all details from each subsection. Let's extract each.
Bug Bounty Program paragraph: "Oversee day-to-day operation of the bug bounty program, including program scope, policy, response targets, and researcher communications.Triage inbound submissions: reproduce and validate findings, de-duplicate against known issues, assign severity, and reject out-of-scope or invalid reports with clear rationale.Make and defend bounty award decisions in coordination with the platform provider and Security leadership.Route confirmed findings to the owning engineering or infrastructure team, track them to closure, and verify fixes before the report is closed.Use recurring submission patterns to drive systemic fixes, scope adjustments, and secure-development feedback rather than one-off patches."
We'll include as one li.
Vulnerability Scanning and Findings Triage paragraph: "Manage and operate enterprise vulnerability scanners across cloud, on-premise, and hybrid assets, ensuring coverage of the full asset inventory and investigating scanning gaps.Configure, tune, and maintain scan policies, credentialed scanning, authenticated checks, and scan schedules to maximize signal and minimize disruption.Triage and prioritize findings using exploitability, asset criticality, and business context (e.g., CVSS, EPSS, CISA KEV, threat intelligence).Assign findings to the correct engineering and infrastructure owners, negotiate remediation timelines, and verify remediation through re-scan or manual validation.Track remediation against SLAs, escalate aging findings, and manage the exception and risk-acceptance process with the GRC team.Produce metrics and reporting on coverage, backlog, mean time to remediate, and SLA compliance for engineering and executive audiences.Monitor emerging CVEs, assess applicability to our environment, and coordinate emergency patching when critical vulnerabilities arise."
CSPM paragraph: "Manage and operate the CSPM platform across our multi-cloud environment, including onboarding new accounts, subscriptions, and projects.Tune policies and baselines, suppress noise, and maintain exception handling so that surfaced findings are consistently actionable.Drive remediation of misconfigurations with cloud and platform owners, and verify that fixes hold over time.Enforce least-privilege access principles and audit cloud permissions, IAM policies, security groups, SCPs, and guardrails on a recurring basis.Support secure architecture reviews for new cloud infrastructure and services."
Agentic Red Team paragraph: "Manage and operate the agentic red-team pentesting platform, including target scoping, scheduling, credentials, and environment onboarding.Define and enforce rules of engagement and safety guardrails so that automated testing does not disrupt production systems.Validate platform output, eliminate false positives, and translate confirmed attack paths into concrete, owner-assigned remediation items.Feed results into the same triage, prioritization, and verification workflow used for scanner and bug bounty findings so there is one prioritized view of risk.Coordinate with third-party penetration testers and use platform coverage to focus manual testing where it adds the most value."
Security Tooling Evaluation and Adoption paragraph: "Research, pilot, and benchmark emerging security products, including AI-driven and agentic tooling, against real problems in our environment rather than vendor demos.Run structured proofs of concept: define success criteria up front, test against known findings, and make a clear recommendation to adopt, defer, or reject.Deploy and integrate selected tooling into existing workflows and ticketing, and own it operationally once it is in production.Automate repetitive triage, enrichment, and reporting work so that engineering time goes to remediation rather than data handling."
Network and Perimeter Security paragraph: "Support enterprise network security infrastructure including firewalls, IDS/IPS, proxies, VPNs, and DDoS mitigation.Perform firewall rule reviews and access control audits to reduce attack surface.Investigate anomalous network activity surfaced by security tooling and escalate to incident response as needed."
We'll include each as li.
Now Requirements: we need to include all bullet points from Key Qualifications. Let's list them precisely.
Key Qualifications text:
"5+ years of experience in infrastructure, network, or cloud security roles.
Experience running or supporting an enterprise vulnerability management program end-to-end, from scanner operation through verified remediation.
Demonstrated ability to triage security findings: reproduce issues, judge real-world exploitability, de-duplicate, and prioritize against business context rather than raw severity scores.
Deep, practical understanding of common vulnerability classes and how they are actually exploited — remote code execution, injection, cross-site scripting, SSRF, insecure deserialization, authentication and authorization bypasses, and denial-of-service and DDoS techniques — sufficient to assess real exploitability rather than defer to a scanner score.
Hands-on proficiency with security testing tooling, including Burp Suite for web application testing and Postman for API testing, along with comparable intercepting proxies and fuzzing tools.
Working coding ability, primarily Python and shell scripting, sufficient to automate triage and reporting, parse and enrich findings, build integrations between security platforms, and write or adapt proof-of-concept code to
Requirements
and Preferred Qualifications underQualifications
or Skills. But we need to avoid thin sections. We'll put Requirements = Key Qualifications. Qualifications = Preferred Qualifications. Skills maybe not needed if covered. Benefits: we have benefits paragraph. Pay: we have compensation range. Schedule: not mentioned; we should not create Schedule section if no content. So omit Schedule. We must not include boilerplate like EEO, CA residents, etc. Remove those. We must preserve all substantive information; do not invent or summarize away detail. So we need to keep details from each section. We need to output only HTML fragment, no /, no markdown fences. Let's craft. Structure:About the role
Position Overview content...
Responsibilities
- Bug Bounty Program: Oversee day-to-day operation... (include all details)
- Vulnerability Scanning and Findings Triage: Manage and operate enterprise vulnerability scanners...
- Cloud Security Posture Management (CSPM): Manage and operate the CSPM platform...
- Agentic Red Team and Continuous Penetration Testing Platform: Manage and operate the agentic red-team pentesting platform...
- Security Tooling Evaluation and Adoption: Research, pilot, and benchmark emerging security products...
- Network and Perimeter Security: Support enterprise network security infrastructure...
Requirements
- 5+ years of experience in infrastructure, network, or cloud security roles.
- Experience running or supporting an enterprise vulnerability management program end-to-end...
- Demonstrated ability to triage security findings...
- Deep, practical understanding of common vulnerability classes...
- Hands-on proficiency with security testing tooling, including Burp Suite and Postman...
- Working coding ability, primarily Python and shell scripting...
- Hands-on experience securing at least one major cloud platform (AWS, Azure, or GCP)...
- Solid understanding of network protocols (TCP/IP, DNS, TLS) and perimeter security technologies.
- Familiarity with security frameworks and standards (NIST CSF, CIS Benchmarks, ISO 27001)...
- Strong written and verbal communication skills...
- Demonstrated curiosity and speed of learning...
- Interest in applying emerging AI capabilities to security operations...
Qualifications
- Experience operating or triaging a public or private bug bounty program on a platform such as HackerOne, Bugcrowd, or Intigriti.
- Offensive security experience: penetration testing, exploit validation, or red-team operations...
- Experience with infrastructure-as-code security (Terraform, CloudFormation) and shift-left security practices.
- Experience securing containerized workloads, including image hardening, registry security, runtime protection, and familiarity with orchestration platforms such as Kubernetes or ECS.
- Experience developing security automation or internal tooling beyond scripting, including work with security platform APIs and CI/CD integrations.
- Exposure to SIEM/SOAR platforms and security telemetry pipelines.
- Familiarity with zero trust network architecture (ZTNA) and micro-segmentation.
- Relevant certifications: AWS Security Specialty, CCSP, CISSP, OSCP, CompTIA Security+, or equivalent.
Benefits
We take care of our people. When you join Cast & Crew, you're backed by a benefits package built around what matters most. From comprehensive medical, dental, and vision coverage, to a 401(k) match, generous PTO, paid parental leave, health and wellness programs, tuition reimbursement, and employee discounts. We’re committed to helping you thrive, professionally, and personally. Benefits Are Subject To Eligibility Requirements.
Pay
The compensation range for this position is: $150,000.00 - $170,000.00 per year.
We need to ensure we didn't include any boilerplate like "Special Work Conditions", "EEO", etc. We omitted Special Work Conditions. Good. Check that we didn't repeat job title. No. Check that we didn't include any placeholder like "commensurate with experience". We omitted that line. Check that we preserved all substantive information: Did we miss any details from Position Overview? Let's capture it fully. Position Overview text: "We are looking for an Infrastructure Security Engineer to run the operational core of our offensive and vulnerability management programs. You will own the tooling that continuously tests our environment — bug bounty, agentic red team, CSPM, and vulnerability scanners — turn the output of those platforms into a prioritized, de-duplicated set of real issues, and drive them to verified closure with engineering and infrastructure teams. This is a hands-on, highly cross-functional role for someone who is as comfortable validating an exploit as they are chasing a fix to completion. We are also looking for someone who is genuinely curious and learns fast. Our security stack changes quickly, and a meaningful part of this role is exploring, testing, and deploying emerging security products — including tooling built on the latest AI capabilities — evaluating whether they actually work in our environment, and putting the ones that do into production." We need to include that inunder About the role. Now Responsibilities: we need to include all details from each subsection. Let's extract each. Bug Bounty Program paragraph: "Oversee day-to-day operation of the bug bounty program, including program scope, policy, response targets, and researcher communications.Triage inbound submissions: reproduce and validate findings, de-duplicate against known issues, assign severity, and reject out-of-scope or invalid reports with clear rationale.Make and defend bounty award decisions in coordination with the platform provider and Security leadership.Route confirmed findings to the owning engineering or infrastructure team, track them to closure, and verify fixes before the report is closed.Use recurring submission patterns to drive systemic fixes, scope adjustments, and secure-development feedback rather than one-off patches." We'll include as one li. Vulnerability Scanning and Findings Triage paragraph: "Manage and operate enterprise vulnerability scanners across cloud, on-premise, and hybrid assets, ensuring coverage of the full asset inventory and investigating scanning gaps.Configure, tune, and maintain scan policies, credentialed scanning, authenticated checks, and scan schedules to maximize signal and minimize disruption.Triage and prioritize findings using exploitability, asset criticality, and business context (e.g., CVSS, EPSS, CISA KEV, threat intelligence).Assign findings to the correct engineering and infrastructure owners, negotiate remediation timelines, and verify remediation through re-scan or manual validation.Track remediation against SLAs, escalate aging findings, and manage the exception and risk-acceptance process with the GRC team.Produce metrics and reporting on coverage, backlog, mean time to remediate, and SLA compliance for engineering and executive audiences.Monitor emerging CVEs, assess applicability to our environment, and coordinate emergency patching when critical vulnerabilities arise." CSPM paragraph: "Manage and operate the CSPM platform across our multi-cloud environment, including onboarding new accounts, subscriptions, and projects.Tune policies and baselines, suppress noise, and maintain exception handling so that surfaced findings are consistently actionable.Drive remediation of misconfigurations with cloud and platform owners, and verify that fixes hold over time.Enforce least-privilege access principles and audit cloud permissions, IAM policies, security groups, SCPs, and guardrails on a recurring basis.Support secure architecture reviews for new cloud infrastructure and services." Agentic Red Team paragraph: "Manage and operate the agentic red-team pentesting platform, including target scoping, scheduling, credentials, and environment onboarding.Define and enforce rules of engagement and safety guardrails so that automated testing does not disrupt production systems.Validate platform output, eliminate false positives, and translate confirmed attack paths into concrete, owner-assigned remediation items.Feed results into the same triage, prioritization, and verification workflow used for scanner and bug bounty findings so there is one prioritized view of risk.Coordinate with third-party penetration testers and use platform coverage to focus manual testing where it adds the most value." Security Tooling Evaluation and Adoption paragraph: "Research, pilot, and benchmark emerging security products, including AI-driven and agentic tooling, against real problems in our environment rather than vendor demos.Run structured proofs of concept: define success criteria up front, test against known findings, and make a clear recommendation to adopt, defer, or reject.Deploy and integrate selected tooling into existing workflows and ticketing, and own it operationally once it is in production.Automate repetitive triage, enrichment, and reporting work so that engineering time goes to remediation rather than data handling." Network and Perimeter Security paragraph: "Support enterprise network security infrastructure including firewalls, IDS/IPS, proxies, VPNs, and DDoS mitigation.Perform firewall rule reviews and access control audits to reduce attack surface.Investigate anomalous network activity surfaced by security tooling and escalate to incident response as needed." We'll include each as li. Now Requirements: we need to include all bullet points from Key Qualifications. Let's list them precisely. Key Qualifications text: "5+ years of experience in infrastructure, network, or cloud security roles. Experience running or supporting an enterprise vulnerability management program end-to-end, from scanner operation through verified remediation. Demonstrated ability to triage security findings: reproduce issues, judge real-world exploitability, de-duplicate, and prioritize against business context rather than raw severity scores. Deep, practical understanding of common vulnerability classes and how they are actually exploited — remote code execution, injection, cross-site scripting, SSRF, insecure deserialization, authentication and authorization bypasses, and denial-of-service and DDoS techniques — sufficient to assess real exploitability rather than defer to a scanner score. Hands-on proficiency with security testing tooling, including Burp Suite for web application testing and Postman for API testing, along with comparable intercepting proxies and fuzzing tools. Working coding ability, primarily Python and shell scripting, sufficient to automate triage and reporting, parse and enrich findings, build integrations between security platforms, and write or adapt proof-of-concept code to