Senior Software Engineer - Infrastructure Security

About Quora:

Quora’s mission is to grow the world's collective intelligence through our two platforms:

• Quora: A global knowledge sharing platform bringing people together to share insights.
• Poe: A platform providing millions of global users with a place to chat, explore, and build with a wide variety of AI language models.

This role supports both our Quora and Poe products.

About the Team and Role:

As a key member of the Security Engineering Team, your mission is to keep Quora safe from security problems by building robust protections around our products, infrastructure, and people. Our small engineering team works on challenging problems in an environment rooted in continuous learning, experimentation, and thinking big.

What We're Looking For:

• Sweat The Right Details: Thrive in understanding details while ruthlessly prioritizing critical issues.
• Right-Size The Solution: Recognize when guidelines and frameworks do not fit and adjust solutions for scalability.
• Ownership: Outcome-focused, able to navigate obstacles, manage time, and communicate vision clearly.

Ideal Candidate Domain Expertise:

Candidates should be capable software engineers with a strong background in at least one of the following:

• Cloud Infrastructure Security: Hands-on experience securing large-scale cloud environments (AWS), building secure infrastructure-as-code (IaC) pipelines using Terraform or CloudFormation, and mastering IAM policies, network segmentation, and VPC design.
• Automation and Secure Development Practices: Implementing "security as code," automating security processes, and integrating SAST, DAST, and dependency scanning into CI/CD pipelines.
• Linux/System Security: Passion for operational rigor, container security, POSIX Capabilities, SECCOMP, LSM, OSQuery, and eBPF.
• Product Security (Nice-to-have): Experience building secure web applications and APIs, with a working grasp of the OWASP Top 10.

Responsibilities:

• Partner with engineering teams to review cloud and compute architecture design changes.
• Establish threat models for cloud and compute paved roads to identify security risks.
• Develop or adopt open-source tools to monitor and harden cloud infrastructure, OS, logging pipelines, and detect intrusions.
• Apply expert knowledge of security best practices for AWS and Kubernetes to inform remediations and control roadmaps.
• Drive the definition and implementation of security policies and monitor conformance.
• Write code for automations supporting threat detection, incident containment, and network access management.
• Conduct initial incident triage and participate in the incident response process.