Senior Security Infrastructure Engineer

Wrike is looking for a Sr. Security Infrastructure Engineer to own and evolve security for our production and cloud environments, with a strong focus on network and infrastructure security. You'll design and harden the controls that keep our world secure — and you'll be the person who spots the gap before it becomes an incident.

* Own and evolve security for Wrike's production and cloud environments, with a strong focus on network and infrastructure security. * Design, implement, and improve network security controls, including: * Internal network segmentation and lateral-movement (east-west) restrictions * WAF operations and tuning * Egress filtering * Risk- and exposure-based sequencing of remediation work * Run structured first-pass security reviews of cloud environments, checking for: * Publicly exposed storage * Open management ports * Gaps in logging/audit trail coverage * Long-lived or stale credentials * Over-privileged principals and accounts * Maintain visibility into our external attack surface, including: * DNS enumeration and certificate transparency log monitoring * External scanning of IP ranges * Dedicated ASM tooling (e.g., Rapid7 Surface Command) * Continuous configuration drift detection tied to an asset inventory with clear ownership assignment * Partner with System & Data Engineering and other ops teams to embed security into architecture and change management (design reviews, sign-offs, "secure by default" patterns). * Educate and coach engineers and operations team on security practices through reviews, consultations, and targeted training. * Identify, track, and determine mitigation strategies for security risks.

* Proven track record as a security subject-matter expert, guiding engineering teams in end-to-end secure system design, with a focus on network architecture and cloud services. * Hands-on experience designing network segmentation/architecture and operating firewall / IDS-IPS platforms in production — you think in **layers**, not a checklist: internal zoning/segmentation to cut east-west movement _and_ edge protection in front of public-facing apps (Cloudflare-style WAF managed + custom rules, rate limiting, bot/DDoS protection, TLS), sequenced by which assets are most exposed or highest-risk first. * Experience running structured, **read-only-first** reviews of cloud environments you've just seen before, working through identity and permissions (Azure RBAC/Entra or GCP IAM — over-privileged principals, standing admin, long-lived credentials), public exposure (open management ports, public storage/blob, public IPs), logging and visibility (activity/audit and flow logs), network rules (NSGs/firewall), and secrets handling — in that order of priority, before proposing changes. Primary focus on Azure permissions and configuration, with working knowledge of GCP and on-prem components. * Experience maintaining attack surface visibility on the assumption that the known asset inventory is **incomplete** — discovering unregistered/shadow assets via DNS enumeration, certificate transparency logs, IP-range/cloud enumeration, external scanning, and ASM tooling (e.g., Rapid7 Surface Command) — run as a continuous, monitored process with drift detection and alerting, not a one-time scan, with ownership assigned to whatever turns up. * Skilled at identifying gaps in existing network and cloud security architecture/configuration and recommending changes (authentication, authorization, network segmentation, bastion host setup, etc.). * Able to lead the technical direction and architecture of our cyber security defense capabilities, including enterprise security posture management. * Strong communicator, able to explain complex security concepts and risks to both technical and non-technical audiences.