Self-Custody Wallet Cloud Platform & Kubernetes Security Engineer — Remote (United States; Canada)

Overview

Lead cloud platform protection for self-custody wallet services across multi-account AWS and Kubernetes clusters. Build least-privilege identities, deployment guardrails, secure infrastructure-as-code and automated vulnerability remediation for sensitive transaction infrastructure.

Requirements

• At least seven years in platform, cloud, infrastructure or security engineering.
• Deep hands-on AWS security knowledge across IAM, network, secrets, logging and organization-level policies.
• Strong production Kubernetes and EKS security, including RBAC, workload identities, pod, admission and network controls.
• Experience securing CI/CD, GitHub Actions, build runners, artifact provenance and software dependencies.
• Infrastructure-as-code security using Terraform, Pulumi or CloudFormation.
• Ability to write production automation using TypeScript, Python, Go or Rust.
• Practical experience securing mission-critical access controls, sensitive data and deployment boundaries.
• Secure enclaves, KMS/HSM, wallet security, service meshes and AI-enabled security tooling are advantageous, not required.

Responsibilities

• Harden multi-account AWS identities, networking, storage and secrets systems.
• Secure Kubernetes/EKS admission, workload isolation, RBAC and network boundaries.
• Design time-bound least-privilege human and service access to production.
• Implement policy-as-code for cloud and deployment systems.
• Protect source-to-production software supply chains and build provenance.
• Build automated cloud misconfiguration discovery and verified remediation.
• Partner with infrastructure and product engineering on secure architecture and incident improvement.

Conditions

• Full-time fully remote role for candidates residing in the United States or Canada.

Tech stack

• AWS
• Kubernetes
• Terraform