Senior Platform Security Engineer - Contract to Hire

About this role

Front is the customer operations platform built for B2B complexity, keeping every team, tool, and customer conversation in sync so companies can scale without losing connection. Others handle simple interactions. Front handles the coordination and context behind complex B2B customer relationships. Over 9,000 companies, including Uber Freight, Navan, and Stripe, rely on Front because it's the only one that can run the operational layer that makes customer-facing work actually succeed. Backed by Sequoia Capital and Salesforce Ventures, Front has raised $204M from leading venture capital firms and independent investors including top executives at Atlassian, Okta, Qualtrics, Zoom, and PagerDuty. Front has received numerous Great Place to Work accolades, including Built In's 100 Best Midsize Places to Work in SF 2025 https://builtin.com/awards/san-francisco/2025/best-midsize-places-to-work?utm_campaign=bptw-2025&utm_content=article&utm_medium=website&utm_source=editorial, Top Places to Work by USA Today 2025 https://topworkplaces.com/company/front/, Y Combinator's list of Top Companies in 2023 https://www.ycombinator.com/topcompanies, #4 on Fortune’s Best Workplaces in the Bay Area™ https://www.greatplacetowork.com/best-workplaces/bay-area/2022?category=small-and-medium ,Inc. Magazine's 2022 Best Workplaces list https://www.inc.com/best-workplaces/2022, and Forbes Best Startup Employers 2022 List https://www.forbes.com/lists/americas-best-startup-employers/?sh=661411d52ad7. Front is building a serious amount of software for itself. GTM Engineers are shipping internal tools and AI agents on top of Salesforce, Gong, Snowflake, Workato, Notion and Claude — automations that our revenue teams now depend on to do their jobs. That software needs somewhere reliable and secure to run. You'll decide how internal software at Front gets built, deployed, secured and operated — the standards, the reference architecture, the review bar — and then you'll implement them yourself and keep them alive as the estate grows. There is no separate team to hand a standards document to. Writing it and building it are the same job. We're hiring for opinions. If you've built a platform practice from nothing before and have views on what good looks like — where to put the guardrails, which conventions are worth enforcing, what to automate before it becomes a habit — we want to hear them in the interview, not after you start. Strong opinions include knowing when to adopt rather than invent: you'll partner closely with our product engineering org and take what already works there. Your users are other engineers, and your job is measured by how fast and safely they can move. You'll report into Corporate IT and work day to day alongside the GTM Systems, Data and product engineering teams whose tooling and engineers the platform depends on. What will you be doing? Define how we build and run internal software - Set the standards for internal engineering at Front: how services are structured and deployed, how environments and secrets work, what gets logged, what "production-ready" means for an internal tool. Write them down, and make the documented path the easiest path. - Partner with our product engineering org and inherit their tooling, patterns and processes wherever they apply to internal platforms. Front already runs production software well — the goal is to extend that foundation to internal systems, not to build a second one. Diverge where internal systems genuinely differ, and be able to say why. - Define the reference architecture for internal systems and the security requirements every internal tool has to meet before it touches governed data. - Own the review bar. Decide what needs review, what can ship freely, and be the person who says no when something isn't ready — with a clear reason and a path forward. - Keep the standards honest as things change. Revisit them when they cause friction, retire the ones that stopped earning their keep, and don't let the documentation drift from what's actually running. - Bring your own opinions and build consensus for them across GTM Systems, Data, Enterprise Security and Legal. You'll need those teams to adopt what you define, which means persuading rather than mandating. Own the infrastructure - Own the cloud infrastructure our internal tools and AI systems run on AWS & Snowflake: compute, networking, data stores, DNS, certificates. - Define infrastructure as code and get us to the point where nothing meaningful is provisioned by hand. Manage state, modules, and drift. - Own environments — production, staging and whatever local story we give engineers — and make them consistent enough that "it worked in staging" means something. - Run the observability stack: metrics, logs, traces and alerting that engineers can self-serve, and that tell you about a problem before a user does. - Own platform cost. Right-size infrastructure and AI/warehouse consumption, attribute spend to the teams and tools driving it, and flag anomalies before they become finance conversations. [TBD: annual spend under management] Build the paved road - Build and maintain CI/CD so GTM Engineers can ship without asking you: pipelines, test and scan gates, deploy and rollback. - Provide golden paths — templates, base images, shared modules and libraries — so the standard way to build something is also the secure, observable, cost-sane way. - Own secrets architecture: centralized storage, scoped short-lived credentials, and rotation that happens without a human remembering. - Reduce toil through automation and self-service. Every request you make unnecessary is worth more than the one you fulfill. Secure the platform and the code that runs on it - Own security of the infrastructure and SDLC for internal systems: IaC scanning, container and image hygiene, dependency and supply-chain scanning, secret detection, and CI/CD pipeline hardening. - Harden cloud configur