Senior Platform Security Engineer - Contract to Hire

Front is the customer operations platform built for B2B complexity, keeping every team, tool, and customer conversation in sync so companies can scale without losing connection. Others handle simple interactions. Front handles the coordination and context behind complex B2B customer relationships. Over 9,000 companies, including Uber Freight, Navan, and Stripe, rely on Front because it's the only one that can run the operational layer that makes customer-facing work actually succeed.

Backed by Sequoia Capital and Salesforce Ventures, Front has raised $204M from leading venture capital firms and independent investors including top executives at Atlassian, Okta, Qualtrics, Zoom, and PagerDuty. Front has received numerous Great Place to Work accolades, including Top Places to Work by USA Today 2025, Y Combinator's list of Top Companies in 2023, #4 on Fortune’s Best Workplaces in the Bay Area ,Inc. Magazine's 2022 Best Workplaces list, and Forbes Best Startup Employers 2022 List.

Front is building a serious amount of software for itself. GTM Engineers are shipping internal tools and AI agents on top of Salesforce, Gong, Snowflake, Workato, Notion and Claude — automations that our revenue teams now depend on to do their jobs.

That software needs somewhere reliable and secure to run. You'll decide how internal software at Front gets built, deployed, secured and operated — the standards, the reference architecture, the review bar — and then you'll implement them yourself and keep them alive as the estate grows. There is no separate team to hand a standards document to. Writing it and building it are the same job.

We're hiring for opinions. If you've built a platform practice from nothing before and have views on what good looks like — where to put the guardrails, which conventions are worth enforcing, what to automate before it becomes a habit — we want to hear them in the interview, not after you start. Strong opinions include knowing when to adopt rather than invent: you'll partner closely with our product engineering org and take what already works there. Your users are other engineers, and your job is measured by how fast and safely they can move.

You'll report into Corporate IT and work day to day alongside the GTM Systems, Data and product engineering teams whose tooling and engineers the platform depends on.

What will you be doing?

Define how we build and run internal software

• Set the standards for internal engineering at Front: how services are structured and deployed, how environments and secrets work, what gets logged, what "production-ready" means for an internal tool. Write them down, and make the documented path the easiest path.

• Partner with our product engineering org and inherit their tooling, patterns and processes wherever they apply to internal platforms. Front already runs production software well — the goal is to extend that foundation to internal systems, not to build a second one. Diverge where internal systems genuinely differ, and be able to say why.

• Define the reference architecture for internal systems and the security requirements every internal tool has to meet before it touches governed data.

• Own the review bar. Decide what needs review, what can ship freely, and be the person who says no when something isn't ready — with a clear reason and a path forward.

• Keep the standards honest as things change. Revisit them when they cause friction, retire the ones that stopped earning their keep, and don't let the documentation drift from what's actually running.

• Bring your own opinions and build consensus for them across GTM Systems, Data, Enterprise Security and Legal. You'll need those teams to adopt what you define, which means persuading rather than mandating.

Own the infrastructure

• Own the cloud infrastructure our internal tools and AI systems run on AWS & Snowflake: compute, networking, data stores, DNS, certificates.

• Define infrastructure as code and get us to the point where nothing meaningful is provisioned by hand. Manage state, modules, and drift.

• Own environments — production, staging and whatever local story we give engineers — and make them consistent enough that "it worked in staging" means something.

• Run the observability stack: metrics, logs, traces and alerting that engineers can self-serve, and that tell you about a problem before a user does.

• Own platform cost. Right-size infrastructure and AI/warehouse consumption, attribute spend to the teams and tools driving it, and flag anomalies before they become finance conversations. [TBD: annual spend under management]

Build the paved road

• Build and maintain CI/CD so GTM Engineers can ship without asking you: pipelines, test and scan gates, deploy and rollback.

• Provide golden paths — templates, base images, shared modules and libraries — so the standard way to build something is also the secure, observable, cost-sane way.

• Own secrets architecture: centralized storage, scoped short-lived credentials, and rotation that happens without a human remembering.

• Reduce toil through automation and self-service. Every request you make unnecessary is worth more than the one you fulfill.

Secure the platform and the code that runs on it

• Own security of the infrastructure and SDLC for internal systems: IaC scanning, container and image hygiene, dependency and supply-chain scanning, secret detection, and CI/CD pipeline hardening.

• Harden cloud configuration against a defined baseline (CIS or equivalent), track drift, and remediate before someone else finds it.

• Run vulnerability management for platform infrastructure and internal application dependencies — scanning, triage, prioritization, patch coordination and verification against agreed SLAs.

• Be the security review on new infrastructure, integrations and AI tooling before they touch governed data, and keep an accurate inventory of what is connected to what.

• Design access and network boundaries so a compromised internal tool has a small blast radius. Enforce least privilege on the infrastructure layer.

• Respond when an incident touches your systems: containment, evidence preservation, and coordination with Enterprise Security, who own corporate detection and incident command.

• Own security monitoring/alerting across platform, integration layer and AI clients; build and tune detections for anomalous query patterns, unusual data egress, off-hours access, privilege escalation.

• Monitor audit logs from AI, Workato and the MCP layer and triaging signal from noise and build automations to trigger alerts.

• Define and implement Data loss prevention controls on paths where governed data leaves — including AI client responses and downstream exports.

Compliance, incident response and RBAC

• Maintain and rehearse incident runbooks and tabletop exercises for named scenarios: leaked credentials, over-broad access grants, prompt-injection data disclosure, third-party integration compromise.

• Assist our GRC team with evidence collection for SOC 2, ISO, and any other relevant compliance frameworks.

• Scope reviews and access audits on a predictable cadence for MCP, Workato and AI client integrations.

• Respond to access requests and access incidents; removing standing access in favor of just-in-time.

• Partner with GTM Systems and Data teams to define access requirements for various data types across systems using RBAC, ABAC, or hybrid access control models.

• Partner with our internal IAM team to implement joiner-mover-leaver (JML) automations and leverage existing access governance tools for periodic access reviews.

AI client layer

• Provide escalation support for troubleshooting MCP and tool integrations with our AI clients (Claude, ChatGPT, Notion, etc.).

• Maintain semantic layer configuration — tool definitions, schema descriptions, semantic views.

• Treat unauthorized exposure through an AI client as a security incident, not a bug.

• Root-causing data quality complaints.

Keep it running, and keep engineers unblocked

• Operate the AI and data plumbing that internal tools consume — Workato recipes, MCP connectors, Snowflake access paths — and absorb upstream API and schema changes without downstream teams noticing.

• Serve as escalation point for platform problems, with clear triage, communication and resolution.

• Participate in on-call [TBD: confirm a rotation exists and who else is in it], and write postmortems with owned, dated follow-ups that you close out.

• Maintain runbooks and architecture documentation so the platform is operable and defensible by more than one person.

• Review other engineers' infrastructure and deployment changes, and raise the bar through that review.

What skills and experience do you need?

Required

• You've established a platform, DevOps or infrastructure practice somewhere it didn't exist — as a founding platform engineer, an early infra hire, or the person who dragged a team onto real standards. You can point at conventions still in use that you wrote.

• Deep hands-on experience running production infrastructure in a major cloud — networking, IAM, compute, and the failure modes of each.

• Infrastructure as code in production at scale: Terraform, Pulumi, CloudFormation or equivalent, including inheriting and refactoring someone else's modules.

• Owning CI/CD pipelines end to end, including test, scan and deploy gates. Containers and orchestration.

• Strong Python or Go for automation, tooling and debugging systems you didn't write.

• Practical infrastructure security: cloud configuration hardening, secrets management, dependency and vulnerability management, and least-privilege access design.

• Clear written communication, and the judgment to know when a standard should be enforced in a pipeline versus argued in a room. You'll be writing documentation engineers actually use and explaining risk to non-technical stakeholders.

• Strong SQL experience, ability to write queries within Snowflake and other BI tools.

• Hands-on security operations experience: log and audit analysis, alert triage, real incident response. Experience reviewing events within a SIEM.

• Experience with implementing and managing SAML/OIDC SSO and SCIM on internal-built tools and integrating such tools with identity providers such as Okta.

• Strong experience with secrets management, including OAuth, API, and JWT service account based integrations.

• Production iPaaS experience including repairing integrations you didn't write.

• Bias towards documentation — if you do something, write it down for others to reference.

Nice to have

• Experience building an internal developer platform, or otherwise being on the team whose customers are other engineers.

• Experience operating LLM or agent infrastructure in production — MCP servers, RAG pipelines, semantic layers, or AI tooling connected to enterprise data.

• Familiarity with AI-specific security risks: prompt injection, tool-use abuse, data leakage through model context, and the controls that mitigate them.

• iPaaS or orchestration experience: Workato, Airflow, dbt, MuleSoft or similar.

• Detection engineering or SIEM exposure (Splunk, Panther, Datadog Security or similar).

• Snowflake or comparable cloud data warehouse operations, including cost and performance tuning.

• Background/experience supporting a GTM or revenue organization.

• Gong, HubSpot, Outreach or similar GTM tooling and their data models.

• Master data management, entity resolution, customer data platforms.

• Comfortable with pipeline, ARR and product-adoption metrics.

What this role is not

• This is not primarily an internal tools building role. GTM Engineers build the tools. You build and secure what they run on. You'll write plenty of code — it's infrastructure, tooling and automation code.

• This is not a customer-facing product role. You won't be working on the Front product or its production infrastructure.

• This is not a research or model-training role. You won't be fine-tuning models or publishing papers.

• This is not a standards-on-paper role. You'll define the practices, but you also build them, enforce them in the pipeline, and operate what you've built. If you're looking for architecture or GRC work that hands off to an implementation team, this isn't it — there is no implementation team.

• This is not a role where you inherit someone else's playbook. We're not asking you to follow our standards. We're asking you to write them.

How we'll measure success

• First 30 days

  • You've mapped the estate: what runs where, who can reach it, what's provisioned by hand, and where the sharpest edges are.

  • You've told us what you think is wrong with it and what you'd do differently.

• First 90 days

  • A first version of our internal platform standards exists, is written down, and has buy-in from the teams who have to follow it.

  • You've closed the top three risks you found.

  • Core infrastructure is defined in code, secrets are centralized with a rotation cadence, and a GTM Engineer can deploy a new internal tool through a documented path without your involvement.

Contractors have the option to work from our office on Tuesdays, Wednesdays, and Thursdays, when our teams are onsite. In-office attendance is optional and not required for this role.

Front provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age or disability. By applying, you acknowledge and agree that you have read and understand the California Recruiting Privacy Notice & EU Privacy Notice

Compensation Range: $187K - $250K

Location

San Francisco, CA

Employment Type

Full time

Department

G&A

Compensation

• Estimated Base Salary $187K – $250K

Individual compensation packages are based on factors unique to each candidate, including job-related skills, experience, qualifications, work location, training, and market conditions. At Front, we take a market-based approach to pay. In addition to cash compensation (base salary, which may include commissions or overtime pay where applicable), Fronteers are eligible to receive equity in the company. This resource will provide additional information on our location zone designations. If you have questions, please contact a member of our recruiting team for additional information.