Senior DevSecOps Engineer

Frame is a compliance infrastructure company powering payments for complex, highly regulated industries. The Senior DevSecOps Engineer will own the cloud infrastructure, reliability systems, security posture, and automated compliance controls that support FrameOS and protect the platform.

Responsibilities:

• Own cloud infrastructure across AWS and Cloudflare, including provisioning, scaling, and cost management
• Build CI/CD pipelines that make deployment fast, predictable, and safe
• Enable engineering org with observability tooling and access to a reliable and robust metrics stack including: logging, tracing, alerting, and the on-call workflows that respond to it
• Operate Kubernetes or equivalent container orchestration at scale
• Own Frame's cloud security posture end to end: IAM and least privilege, account structure, network segmentation, encryption at rest and in transit, and separation of environments
• Design and optimize detection engineering pipelines and incident response workflows to ensure low-noise, actionable security alerting
• Lead security incident response, including the writeup and the follow through
• Keep Frame up-to-date on compliance and coverage for OWASP identified threats and vulnerabilities identified from other key security organizations and communities
• Translate SOC 2 and PCI DSS control requirements into automated technical controls, so evidence is a byproduct of how we operate
• Serve as the technical subject matter expert behind our compliance team, answering the engineering-level questions that come out of audits, sponsor bank reviews, and partner security questionnaires
• Report security posture and control maturity to engineering leadership on a regular cadence

Requirements:

• 5+ years of DevOps, infrastructure, or cloud security engineering experience
• Deep AWS experience, including VPC, IAM, RDS, EC2, ECR, EKS, KMS, and other core AWS services
• Proficiency with infrastructure-as-code tools like Terraform, Pulumi, or CDK, and a willingness to ship your own remediation rather than file tickets for someone else
• Container and orchestration security experience: image scanning, runtime hardening, admission controls
• Hands-on experience with baseline pipeline security (SCA, secrets scanning, static analysis) and familiarity with broader AppSec concepts (DAST, policy-as-code, penetration testing)
• Strong scripting in Python, Ruby, or Go and enough fluency in our stack to review code and open pull requests, not just read scanner output
• Mindset of enabling the rest of the team. We want to build a security, ops, and observability posture that is defined,hardened, and then shared and maintained by the team. Help the team help themselves. You're still the owner of dev ops and security, but other people in eng should eventually know how to interact and use tools and processes relevant to their jobs
• Treats reliability and security as features, not backstops
• You build infrastructure that other engineers can rely on without thinking about it, and you fix root causes rather than patching symptoms
• You move quickly when systems are on fire, and methodically when they aren't
• You can sequence work by real risk when you cannot do everything at once, and explain that sequencing to a founder, an auditor, and a bank partner in three different registers
• Experience in fintech, payments, or a regulated infrastructure environment is a strong plus
• experience standing up a security function as the first dedicated hire
• Familiarity with tokenization or vaulting architectures, detection engineering, or a sponsor bank model is also valued