About the company
PagerDuty is the global leader in AI-first digital operations, orchestrating AI agents and automated workflows with context from over 750 integrations. Trusted by approximately two-thirds of the Fortune 100.
Responsibilities
- Harden AWS and Kubernetes environments against CIS Benchmarks, DISA STIGs, and FedRAMP Moderate baselines across a multi-account, multi-org footprint
- Own Kubernetes and container security end to end — harden EKS clusters and Istio service mesh, design and enforce Kubernetes RBAC and least-privilege workload identity (IRSA/pod identity)
- Build and operate security-focused platforms, services, and automation at scale using Python/Go, Terraform, and Kubernetes policy-as-code
- Own PKI and encryption standards — certificate lifecycle, KMS-backed key management and rotation, TLS/mTLS, encryption-at-rest and in-transit
- Design and roll out Service Control Policy (SCP) guardrails and least-privilege IAM/PAM across dozens of accounts
- Build lightweight agentic solutions to streamline security work: posture triage, threat modeling, risk assessment, incident enrichment
- Shape detection strategy for Kubernetes/Istio and identity domains, authoring and tuning detections in the SIEM stack
- Participate in on-call rotation and act as Incident Commander during incidents
Requirements
- Strong software engineering background building and operating production systems at scale
- Proficiency in Python and/or Go and Infrastructure as Code (Terraform)
- 5+ years in security engineering with hands-on expertise securing Kubernetes and containerized environments — EKS, Kubernetes RBAC, admission control (OPA/Gatekeeper or Kyverno), network policy, workload identity, container runtime/image security, Istio
- Deep expertise with AWS security services and least-privilege IAM/PAM — IAM, Organizations/SCPs, Secrets Manager, KMS, GuardDuty, CloudTrail, Config
- Ability to automate security controls as code and inform detection strategy in a modern SIEM (CrowdStrike NG-SIEM, Splunk)
Conditions
- This role requires working 2 days a week from the Atlanta office