Senior Platform Security Engineer

About This RoleAI processing…

Key Responsibilities

• 1
  Own software engineering projects end-to-end on a highly autonomous, horizontally integrated team with a lot of leverage. This is a code-forward role!
• 2
  Define what identity means for autonomous agents and other non-human actors at Discord (how they're provisioned, scoped, authenticated, authorized, and audited). As the role of these actors grows, and create primitives to implement that vision.
• 3
  Build and evolve Access , Discord's employee authorization platform, to make permissions discoverable, role-based, least privilege, and self-serve; check out our blog post to learn more!
• 4
  Design and harden our Zero Trust architecture, spanning human and service-to-service auth*n for Discord’s internal tooling.
• 5
  Automate continuous permission right-sizing in the spirit of least privilege.
• 6
  Develop and apply secure baselines for cloud identity, and help secure our software supply chain from the dev environment through CI/CD and into production.
• 7
  Consult on risk assessments, architectural designs, threat models, code reviews, and more, pragmatically balancing security with other business considerations.

Requirements

• 5+ years of experience building and operating production systems or infrastructure
• 3+ years of experience writing software in a general-purpose programming language (we mainly use Python, TypeScript, and Rust)
• 3+ years of experience securing systems with millions of users
• Experience building or operating identity and access management systems: authentication, authorization, or access control at scale
• Understanding of modern authentication and authorization concepts (e.g. RBAC, OAuth, OIDC, SSO, Zero Trust network architectures, mTLS, cloud IAM)
• Experience building in and securing multi-cloud environments (e.g. GCP, Cloudflare, AWS)
• Experience designing and building software for customers (internal or external) beyond your immediate team
• Experience defining and orchestrating containers (e.g. via Kubernetes, Docker, Distroless, OCI)
• Familiarity with build and CI/CD technologies (e.g. Terraform, Bazel, Buildkite)
• Provisioned or managed service and workload identity using PKI, including issuing and operating mTLS between services
• Experience with Zero Trust platforms such as Cloudflare Access and Teleport, for auditable access to apps, hosts, and internal systems
• Experience with secrets management systems (e.g. Vault, or a cloud KMS or secrets manager), including rotation and least-privilege access to secrets
• Developed and debugged distributed systems atop GCP, Cloudflare, and/or AWS
• Led complex migrations or risk management programs across an engineering organization
• Built or operated a service mesh (e.g. Envoy, Istio)
• Managed and secured VMs or bare-metal hosts (e.g. Linux, Salt)
• Practices to discover industry tools and knowledge that can multiply your team's impact

Perks & Benefits