Principal Infrastructure Security Engineer

Location: Dublin, IE

Ridgeline is hiring a Principal Infrastructure Security Engineer to set the direction for cloud and infrastructure security across every product line, account, and environment. You will define the architecture vision and the security invariants that guide engineering decisions, and you will be accountable for Ridgeline’s overall cloud security posture.

You will work with Engineering, Product Management, and Technology leaders on cloud security trade-offs that carry business, regulatory, or reputational consequences. You will also help build the team's technical culture and develop Staff-level engineers, so that its standards, detection frameworks, and architectural judgment last beyond any single project. We believe in a culture where security is everyone's responsibility and an integral part of our engineering philosophy.

At Ridgeline, how we work matters as much as what we build. Ridgeliners act like owners, choose growth over comfort, and communicate with transparency. We assume positive intent, bias toward action, and bring solutions—not just problems. We celebrate wins, learn from setbacks, and thrive in a resilient, collaborative, high-performing culture.

If this excites you, we’d love to meet you.

You must be permitted to work in Ireland, including under EU work authorization, without the need for employer sponsorship.

What You’ll Do

Own the multi-year cloud security architecture vision and the security invariants that govern engineering decisions across all product lines, AWS accounts, and infrastructure.
Set the technical strategy for cloud security tooling and automation, including how AI changes security operations, and make the build-versus-buy decisions that determine what the team can do for years.
Drive company-wide guardrails and controls in our AWS environment (e.g., SCPs, IAM boundaries, AWS managed security services, custom-built solutions, and policy-as-code), and implement the standards and processes that keep them enforced.
Develop threat models and security approaches, and identify emerging threats to identity, data, AI workloads, and infrastructure before they become problems.
Create frameworks and methodologies for securely integrating third-party cloud services and internal platforms, and see them adopted across Ridgeline.
Anticipate broad changes in cloud and infrastructure security, identify where our current approach stops scaling, and propose fixes before it does.
Build AI and automation frameworks, and partner across functions to deploy reusable agents that multiple teams use.
Deliver large, cross-team projects on schedule and at high quality, breaking complex programs into pieces the contributing teams can execute.
Build the cloud security team's long-term technical culture, develop Staff-level cloud security engineers, and sponsor the next leaders at Ridgeline.
Shape C-suite and board-level decisions on cloud security investment, cloud adoption strategy, and organizational risk acceptance.

Who You Are & What Makes You Qualified

10+ years of relevant experience in cloud security or platform engineering, including experience leading large cross-team initiatives with company-wide impact and delivering them on schedule.
Advanced proficiency in at least one high-level language (Python strongly preferred; Kotlin or TypeScript a plus).
Expert-level experience with AWS, especially in the following areas:
Identity and Access Management (IAM, Orgs & SCPs, Identity Center)
Networking (VPC, Security Groups, Transit Gateway, Load Balancers, Network Firewall)
Compute (EKS, ECS, Lambda)
Data Persistence (S3, Aurora, DynamoDB)
Logging & Monitoring (GuardDuty, CloudTrail, CloudWatch)
Demonstrated success defining enterprise-wide access management strategy and policy frameworks (IAM/SCPs), and cloud security architecture that engineering teams adopted.
Deep understanding of cloud workload protection, infrastructure monitoring, and threat detection in AWS-native environments.
Expert-level experience securing Kubernetes and Amazon EKS (including EKS Auto Mode): cluster access control, network policy, Istio service mesh, Kyverno admission policy, and image signing with cosign.