Senior Infrastructure Security Engineer, Matter Labs

• 5+ years of hands-on infrastructure or detection-and-response security experience
• Production experience securing a cloud-based identity and collaboration platform at scale, beyond default settings. You can speak to specific policies you've implemented, third-party app governance you've run, and incidents you've worked
• Hands-on experience with a modern SIEM and SOAR: writing detections, onboarding log sources, building response playbooks, and tuning to reduce false positives
• Strong cloud security background, including IAM, network controls, workload identity, and organization-level guardrails
• Practical experience securing a macOS-dominant endpoint fleet: MDM, endpoint hardening baselines, and EDR. Comfort reasoning about Mac-specific attack paths and telemetry
• Familiarity with Infrastructure as Code, secrets management, and security automation
• Real incident response experience. You've been on-call for security and led investigations to conclusion
• Clear, constructive technical communication across engineering and non-engineering stakeholders

Desirable

• Join Matter Labs as a Senior Infrastructure Security Engineer and help secure the corporate and production infrastructure that powers ZKsync
• You'll own defenses across identity, endpoint, and detection-and-response
• You'll partner closely with IT Ops, DevOps, Protocol Security, and Engineering to make security a default property of how we operate, not a checkpoint
• This role is ideal for someone who enjoys building durable detections instead of triaging noise, and is motivated by the mission of protecting open-source, decentralized infrastructure
• Matter Labs runs a deliberately lean, high-leverage security organization. You won't be one of fifty detection engineers
• You'll own the corporate detection-and-response stack and have a direct line to the people building ZKsync
• The work matters: this infrastructure protects an open-source ecosystem, the team behind it, and a meaningful chunk of value moving on Ethereum L2
• Identity & Collaboration Security Own the security configuration of our identity and collaboration stack: identity and access policies, third-party app governance, DLP, context-aware access, and admin audit
• Drive least-privilege and phishing-resistant MFA across the org
• Detection & Response Build, tune, and maintain detections
• Design response playbooks for high-signal alerts, onboard new log sources, and own the detection-as-code pipeline
• Reduce mean-time-to-detect and mean-time-to-respond on real incidents
• Cloud & Infrastructure Security Harden our cloud footprint, Kubernetes clusters, and CI/CD pipelines
• Review Infrastructure as Code for security regressions, embed guardrails, and partner with DevOps on secrets management and supply-chain controls
• Endpoint Security Own the security posture of the endpoint estate, including MDM configuration, baseline hardening, EDR tuning, and endpoint telemetry
• Make sure the controls hold up without making engineers' machines miserable to use
• Incident Response Lead and participate in security incident investigations end-to-end: containment, forensics, root cause, remediation, and post-mortem
• Improve runbooks and detections after every incident
• Secure Systems Design Run threat models and architecture reviews for new internal systems and infrastructure changes
• Translate findings into concrete, prioritized work, not lists of concerns
• Cross-Team Collaboration Work alongside Protocol Security, DevOps, IT Ops, and Product Engineering
• Raise risks constructively, write clearly, and influence without owning every system