Senior Security Engineer

The big picture: Axios is a respected media company dedicated to providing trustworthy, award-winning news content in an audience-first format known as Smart Brevity™. We are looking for a Senior Security Engineer with strong cloud infrastructure and AI security experience to lead our defensive posture, drive threat modeling and vulnerability management, and embed security controls - including AI-driven defense and monitoring - across our platform and automation pipelines.

Why it matters: As a Senior Security Engineer at Axios, you will architect and implement proactive security strategies to protect our audience, platform, and data assets against evolving threat vectors, including AI-driven attacks. In this role, you will define our security roadmap, leverage internal and third-party AI defense tools, and ensure our cloud systems remain resilient, secure by default, and capable of automated threat detection and response.

Responsibilities

• Lead the architectural design and implementation of security controls across cloud infrastructure, platform services, and AI integrations.
• Drive vulnerability management, threat modeling, incident response, and proactive security assessments across AWS, Kubernetes, and AI application environments.
• Shape, maintain, and execute the company’s long-term security roadmap in close alignment with engineering and executive leadership.
• Embed automated security testing, SAST/DAST, and AI-driven compliance checks directly into CI/CD pipelines and infrastructure-as-code workflows.
• Oversee identity and access management (IAM), secrets management, encryption protocols, and zero-trust architecture standards.
• Evaluate, deploy, and maintain internal AI security tools and modern third-party defensive solutions to detect, mitigate, and respond to AI-driven threats and sophisticated attack vectors in real time.
• Promote a strong security culture across engineering by conducting threat modeling workshops and coaching teams on secure coding and infrastructure practices.
• Partner with product, infrastructure, data, and QE teams to ensure security is integrated seamlessly into every stage of the development lifecycle.

What success looks like

• Security & Compliance: Focused on proactive security initiatives, including automated vulnerability scans, implementation of controls, remediation, and contributions to the long-term security roadmap.
• Cloud Security Architecture: Hardened, reviewed, and optimized AWS and Kubernetes infrastructure security to meet strict compliance, resilience, and least-privilege access standards.
• DevSecOps & Automation: Integrated automated security scans, secret detection, and vulnerability gates seamlessly into CI/CD pipelines without disrupting developer velocity.
• Security Tooling Adoption: Evaluated, piloted, and deployed advanced security and defensive AI tools that measurably enhanced threat detection speed and reduced exposure risk.
• Threat Detection & Response: Established robust security monitoring, SIEM alerting, and incident response playbooks to maintain real-time visibility and rapid response capabilities across all production platforms.
• Cross-Functional Security Leadership: Partnered with engineering, product, and QE teams to instill a security-first culture, conduct threat modeling workshops, and guide technical teams on risk mitigation.
• AI Defense & Security: Evaluated and deployed internal AI security tools and 3rd-party defensive solutions to proactively safeguard infrastructure, applications, and corporate assets against AI-driven threats and emerging attack vectors.

• Deep expertise in cloud and application security, including threat modeling, vulnerability scanning, penetration testing, IAM, secrets management, AI security, and compliance frameworks.
• Strong working knowledge of AWS infrastructure and security controls (IAM, KMS, EKS, RDS, S3).
• Experience hardening Kubernetes clusters, runtime security, container scanning, and network policy enforcement.
• Proficiency in integrating SAST/DAST and security automation into CI/CD pipelines (GitHub Actions).
• Solid scripting or programming skills in Python, Go, or Bash for security tooling and automated remediation.
• Hands-on experience with SIEM, security logging, automated threat intelligence, and AI-powered monitoring frameworks (Prometheus, Grafana, Loki, or modern SOC tooling).
• Demonstrated leadership in driving security initiatives, defining policy, and guiding engineering teams on security risk.
• Exceptional communication and stakeholder management skills, with the ability to effectively balance security requirements and business agility.