Staff Software Engineer, Platform Security

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes: About Decagon (company description) and About The Team (team description) and About The Role (role description). Also "Your background looks something like this" (requirements/qualifications). Also "Even better if you have" (preferred qualifications). Also "Compensation $200K – $400K + Offers Equity". Also Benefits list. We need to map content to sections. We should not repeat job title as heading. The job title is "founding Platform Engineer, Security". Not to be used as heading. We need to decide sections: - About the role: we have description of role responsibilities. Could put under

About the role

with paragraphs and maybe list of responsibilities. - Responsibilities: could be separate but we might combine. The instruction: prefer few substantive sections over many thin ones. We could have About the role covering responsibilities. Could also have Requirements/Qualifications/Skills. We have "Your background looks something like this" which includes requirements: 8+ years building and operating production infrastructure, deep knowledge of GCP/AWS, proficiency with IaC, strong coding ability, experience applying AI-assisted tooling, experience with secure container deployment, observability, clear communication. That's qualifications/requirements. Then "Even better if you have" is preferred qualifications. We could have a Requirements section (mandatory) and a Qualifications section (preferred) or combine. We have Benefits list. We have Pay: "$200K – $400K + Offers Equity". That's specific. Schedule: not mentioned. So we should not include Schedule section. We should not include sections with filler like "commensurate with experience". Not present. Thus sections: About the role, Requirements, Qualifications (or Skills), Benefits, Pay. We could also include a short paragraph for About Decagon/Team? The instruction: "About Decagon" and "About The Team" maybe could be considered company overview but not required sections. The allowed headings list includes About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. No generic About company. So we should not include headings for About Decagon or About The Team. We need to preserve ALL substantive information; but we cannot invent headings not allowed. However we could embed that info within a paragraph under About the role or maybe under a generic

without heading? The instruction: "Output ONLY the HTML fragment — no /, no markdown code fences." It didn't forbid other headings besides those listed, but says: "use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It implies we should use those headings for sections; but could we also use other headings? Likely they want only those headings. To be safe, we can incorporate company/team info into a paragraph under About the role or maybe under a leading

before any heading. The instruction: "Do NOT repeat the job title as a heading (the page already shows it) and do NOT put Job ID / requisition numbers as headings as headings — fold minor metadata into a short

or drop it." So we can have a leading

with company/team description. Thus structure:

About Decagon ... (company description)

About The Team ... (team description)

Then

About the role

with description paragraphs and maybe a

for responsibilities. Then

Requirements

with
of mandatory requirements. Then

Qualifications

(or Skills) with
of preferred qualifications. Then

Benefits

with
of benefits. Then

Pay

with

compensation. No Schedule. We must preserve all substantive information: include details like "multi-tenant infrastructure", "golden paths", etc. Ensure we don't lose any. Let's extract responsibilities from About The Role paragraph: - Design and implement secure, multi-tenant infrastructure that isolates customer data while enabling efficient AI model serving across our platform - Build "golden paths" for security including service templates, libraries, terraform policies, and automation, so new services are secure and production-ready by default - Own infrastructure-as-code (Terraform) and GitOps best practices, including reusable modules and policy-as-code - Expand and help operate the platforms behind alerting detection, secrets management, IAM, and automated remediation, integrating them cleanly into CI/CD and developer workflows - Partner with Security, Infrastructure, and product engineering teams to translate enterprise and compliance requirements (SOC 2, ISO 27001, GDPR) into reliable, automated technical controls - Participate in security on-call and continuously raise the bar on operability, runbooks, and incident learnings We'll put those as

• . Now requirements (mandatory) from "Your background looks something like this": - 8+ years building and operating production infrastructure, with meaningful exposure to security or a strong interest in moving deeper into security problems - Deep knowledge of Google Cloud Platform and/or AWS, including compute, networking, IAM, and security services - Proficiency with infrastructure-as-code (Terraform, Ansible, or similar) and a track record of building developer-facing tooling and automation - Strong coding ability in at least one systems language (eg. Python, Go, TypeScript) and comfort building paved-path tooling teams actually adopt - Experience applying AI-assisted tooling (Cursor, Claude Code, and similar) to make engineers dramatically more effective - Experience with secure container deployment, service mesh, and Kubernetes security best practices - Observability and incident-response tooling experience (instrumentation, alerting, dashboards), with a bias toward eliminating toil - Clear written communication and the ability to turn ambiguous requirements into simple, reliable designs We'll list as
  . Preferred qualifications (Even better if you have): - A track record of being an early or founding platform/infrastructure/security engineer at another company - Experience building internal platforms: service templates, paved-road deployment, self-serve environments, or developer portals - A security-minded approach to the software supply chain (provenance, secrets, least privilege) and familiarity with static analysis tooling (Semgrep, CodeQL) - Experience with detection and response data pipelines (Kafka/Pulsar, Splunk/Panther/RunReveal, or similar) - Knowledge of enterprise compliance requirements (SOC 2, ISO 27001, GDPR) from an infrastructure and platform perspective We'll list as
  under Qualifications. Benefits list: - Medical, Dental, and Vision benefits for you and your family - Life Insurance and Disability Benefits - Retirement Plan (e.g., 401K, pension) - Parental Leave - Fertility and family building benefits through Carrot - Monthly stipend to support your wellness, lifestyle, and work-life balance - Daily lunches and snacks in the office to keep you at your best - Take what you need vacation policy (subject to local requirements; UK employees receive 25 days of statutory leave) We'll list as
  . Pay: "$200K – $400K + Offers Equity". We'll put in

  . Now we need to include company/team description paragraphs before headings. Let's craft About Decagon paragraph: "Decagon is the leading conversational AI platform empowering every brand to deliver concierge customer experiences. Our technology enables industry-defining enterprises like Avis Budget Group, Block’s Cash App and Square, Chime, Oura Health, and Hunter Douglas to deploy AI agents that power personalized, deeply satisfying interactions across voice, chat, email, SMS, and every other channel. We’re building a future where customer experiences are being redefined from support tickets and hold music to faster resolutions, richer conversations, and deeper relationships. We’re proud to be backed by world-class investors who share that vision, including a16z, Accel, Bain Capital Ventures, Coatue, and Index Ventures, along with many others. We’re an in-office company, driven by a shared commitment to excellence and velocity. Our values — Just Get It Done, Invent What Customers Want, Winner’s Mindset, and The Polymath Principle — shape how we work and grow as a team." About The Team paragraph: "The Security Engineering team at Decagon protects the platform that powers the most advanced conversational AI agents for enterprise customers across voice, chat, email, and SMS. We build the security foundations that enable Decagon's AI agents to handle sensitive customer data with complete trust while defending against sophisticated, AI-enabled threats at massive scale. This role sits at the intersection of Security and Infrastructure. Like the rest of our Infrastructure org, we believe the best security comes from paved paths, strong SLAs, and high-quality systems that other engineers can rely on by default. Our mission is to secure magical support experiences, ensuring that AI agents and human agents can collaborate safely to help users resolve their issues while maintaining the highest standards of security and privacy." Now after that, we put headings. We must not include any boilerplate like EEO etc. Not present. Now output HTML fragment. Let's construct:

  Decagon is the leading conversational AI platform ...

  The Security Engineering team at Decagon ...

  About the role

  We're hiring our founding Platform Engineer, Security to design, build, and operate the security infrastructure that powers Decagon's AI platform. This is a builder's role: you'll spend your time creating durable, well-engineered systems including paved paths for secure service creation, security tooling that automatically applies secure configurations, and infrastructure-as-code that makes it easy for every engineer at Decagon to do the right thing. As the first dedicated engineer at this intersection, you'll have outsized impact on how security infrastructure is built here, and you'll shape the technical direction of the infrastructure security program. You'll also help us invest in automation, observability, and self-service so the team operates with confidence. The work is close to the business. Decagon serves some of the world's most security-conscious enterprises, including major financial-services institutions, and the security platform you build directly unlocks these high-value deals. This role offers a clear runway to grow your impact across security, infrastructure, and platform engineering.

  • Design and implement secure, multi-tenant infrastructure that isolates customer data while enabling efficient AI model serving across our platform
  • Build "golden paths" for security including service templates, libraries, terraform policies, and automation, so new services are secure and production-ready by default
  • Own infrastructure-as-code (Terraform) and GitOps best practices, including reusable modules and policy-as-code
  • Expand and help operate the platforms behind alerting detection, secrets management, IAM, and automated remediation, integrating them cleanly into CI/CD and developer workflows
  • Partner with Security, Infrastructure, and product engineering teams to translate enterprise and compliance requirements (SOC 2, ISO 27001, GDPR) into reliable, automated technical controls
  • Participate in security on-call and continuously raise the bar on operability, runbooks, and incident learnings

  Requirements

  • 8+ years building and operating production infrastructure, with meaningful exposure to security or a strong interest in moving deeper into security problems
  • Deep knowledge of Google Cloud Platform and/or AWS, including compute, networking, IAM, and security services
  • Proficiency with infrastructure-as-code (Terraform, Ansible, or similar) and a track record of building developer-facing tooling and automation
  • Strong coding ability in at least one systems language (eg. Python, Go, TypeScript) and