Sr Platform Security Engineer

This role will be hybrid in Austin, TX.

Key Responsibilities

Design, implement, and continuously improve security controls across BusPatrol’s AWS multi-account environments.

Establish least-privilege identity patterns using AWS IAM, IAM Identity Center, Entra ID, permission sets, groups, cross-account roles, service roles, and time-bound elevated access where appropriate.

Build and maintain secure, reusable Terraform modules and AWS CDK constructs for platform services, security controls, logging, encryption, networking, and account/environment guardrails.

Help evolve AWS Organizations, Control Tower, service control policies, account boundaries, and shared-services patterns to reduce blast radius and improve governance.

Secure cloud networking through practical controls for VPCs, routing, security groups, network ACLs, WAF, private connectivity, site-to-site VPNs, Direct Connect, and related network segmentation strategies.

Implement and operate secrets-management and encryption patterns using AWS KMS, Secrets Manager, Parameter Store, TLS, and automated credential rotation.

Integrate security checks into GitHub Actions and other delivery workflows, including infrastructure validation, dependency and vulnerability scanning, container/image security, SBOMs, signing, and policy enforcement.

Develop policy-as-code and preventive guardrails using appropriate tools such as AWS Config, SCPs, CloudFormation Guard, OPA, Conftest, Checkov, tfsec, or equivalent technologies.

Partner with engineering teams to define secure golden paths, platform templates, and documented patterns that make the safest implementation the easiest implementation.

Operate and improve cloud security telemetry and findings across services such as GuardDuty, Security Hub, CloudTrail, AWS Config, CloudWatch, and Datadog.

Triage, prioritize, and remediate platform security findings from CNAPP, CSPM, vulnerability-management, penetration-testing, and internal assessment tools, including Wiz or comparable platforms.

Support incident response, containment, root-cause analysis, and post-incident improvement for cloud, infrastructure, identity, and platform security events.

Produce concise architecture decisions, threat-informed control designs, runbooks, evidence, and operational documentation that engineering teams can use.

Collaborate with Cyber Security and GRC on SOC 2, ISO 27001, CIS, NIST, customer assurance, and audit-readiness activities without turning compliance into a manual exercise.

Mentor engineers through design reviews, infrastructure pull requests, office hours, and practical security enablement.

Contribute to secure AI-enabled engineering and platform workflows by protecting sensitive data, non-human identities, secrets, tool permissions, logging, and production change controls.

Qualifications

8–10+ years of professional experience in cloud security, platform security, DevSecOps, infrastructure security, or a related engineering discipline.

Deep hands-on experience securing production AWS environments, preferably across multiple accounts and environments.

Strong knowledge of AWS IAM, IAM Identity Center, KMS, Secrets Manager, Parameter Store, CloudTrail, GuardDuty, Security Hub, AWS Config, Organizations, SCPs, and VPC security.

Demonstrated ability to implement infrastructure security through Terraform, AWS CDK, CloudFormation, or comparable infrastructure-as-code tooling.

Experience designing and enforcing least-privilege access, role-based access, group-based permissions, cross-account access, and privileged-access controls.

Experience securing CI/CD pipelines, source-control workflows, build runners, artifacts, containers, and deployment processes.

Practical understanding of cloud network security, including segmentation, routing, security groups, WAF, private connectivity, site-to-site VPNs, and Direct Connect concepts.

Experience with vulnerability management, security findings, risk prioritization, remediation tracking, and verification of control effectiveness.

Working knowledge of policy-as-code, preventive and detective controls, security automation, and compliance evidence collection.

Strong Linux, networking, scripting, Git, and troubleshooting skills.

Experience responding to or supporting security incidents in production environments.

Ability to communicate clearly with engineers, architects, security professionals, auditors, and technical leadership.

Strong written documentation habits and a pragmatic, automation-first mindset.

Preferred Qualifications

Experience with AWS Control Tower, landing zones, account vending, shared services, or large-scale AWS governance.

Experience with Wiz, Qualys, Prisma Cloud, Lacework, or comparable CNAPP/CSPM and vulnerability-management platforms.

Experience with GitHub Actions, OIDC federation, artifact registries, image signing, SBOM tooling, and supply-chain security.

Experience with Kubernetes or ECS security, container hardening, runtime controls, and workload identity.

Experience with Zero Trust, data protection, PII tokenization or redaction, DLP, or secure production-data access patterns.

Experience supporting SOC 2, ISO 27001, CIS, NIST, or similar security and compliance frameworks.

Familiarity with Backstage, internal developer platforms, golden paths, or security self-service tooling.

Experience securing AI products, AI agents, model-serving infrastructure, or non-human identities.

Experience with site-to-site VPNs, Direct Connect, Transit Gateway, private endpoints, and hybrid-cloud connectivity.

AWS Security, AWS Solutions Architect, AWS DevOps Engineer, CISSP, CCSP, or relevant equivalent certification.

Core Skills

AWS platform and cloud security

IAM, identity governance, and privileged access

Infrastructure as Code security

Cloud networking and segmentation

CI/CD and software supply-chain security

Secrets management and encryption

Policy-as-code and security guardrails

Vulnerability and findings management

Security automation and observability

Incident response and root-cause analysis

Technical documentation and enablement

Cross-functional engineering leadership

Why BusPatrol?

Who We Are

BusPatrol is a technology company with a public safety mission. Our AI, machine learning, telematics, and cloud-connected systems help communities make the journey to and from school safer for students.

What We Offer

Competitive salary and benefits package

Unlimited PTO

A purpose-driven career focused on protecting children and improving public safety

The opportunity to work with modern cloud, automation, AI, and security technologies

A culture of safety, learning, teamwork, and meaningful technical impact

Be Part of Something Bigger

This is an opportunity to build security capabilities for a mission-critical platform, work directly across cloud infrastructure and engineering, and establish durable controls that enable teams to move faster with confidence. You will join a pragmatic, collaborative culture that values safety, connection, excellence, impact, ownership, and continuous learning.

Compensation Note

The US salary range for this position will be provided in the posting. Salary ranges are determined by role, level, location, and additional factors including job-related skills, experience, and relevant education or training. Compensation details in US postings reflect base salary only and do not include bonus, commission, or benefits where applicable.

Equal Opportunity

BusPatrol is an equal opportunity employer. EOE/AA Disability-Veteran.