[Remote] Core Software Engineer, Security & Platform

Note: The job is a remote job and is open to candidates in USA. CARTO is the world’s leading cloud-native spatial analytics platform, built to break down the silos of traditional GIS. They are seeking a Senior Software Engineer focused on Security & Platform Hardening to improve the security of their platform, strengthen cloud infrastructure, and integrate security into the development workflow.ResponsibilitiesImprove the security of the platform through code. Work directly in the CARTO codebase to identify, prioritize, and fix security weaknesses. This may involve refactoring existing components, redesigning risky flows, improving authorization boundaries, strengthening input validation, removing unsafe patterns, or building new platform capabilities that make secure development easier for everyoneStrengthen our cloud and infrastructure foundations. Work with our infrastructure and platform teams to harden CARTO’s cloud-native environments across GCP and AWS. You will contribute to areas such as IAM, Kubernetes, containerized workloads, networking, workload isolation, Infrastructure as Code, and secure-by-default deployment patternsMake security part of the development workflow. Build and improve tools, checks, libraries, CI/CD integrations, and engineering practices that help developers catch security issues early. The goal is not to create gates that slow teams down, but to make the secure path the easiest pathImprove supply-chain security. Help protect CARTO from modern supply-chain attacks by improving dependency management, build integrity, container security, artifact provenance, CI/CD security, and automated scanning. Stay up to date with emerging attack techniques and translate that knowledge into practical protectionsUse AI to improve security. Experiment with the latest AI models and tools to assess and improve CARTO’s security posture. This could include AI-assisted code review, automated vulnerability discovery, codebase analysis, threat modeling, dependency analysis, or internal agents that continuously look for risky patterns and misconfigurationsSecure AI and agentic systems. CARTO is building an Agentic GIS platform, which creates new security challenges. You will help us reason about and defend against risks such as prompt injection, tool misuse, data leakage, privilege escalation through agents, untrusted content flowing into automated workflows, and unsafe model/tool interactionsRaise the security bar across engineering. Partner with engineering teams to review designs, identify risks, and implement improvements. Help make every team more security-aware while remaining pragmatic, collaborative, and focused on enabling product velocitySkills5+ years of experience as a software engineer, platform engineer, infrastructure engineer, or security-focused engineerStrong hands-on programming skills in at least one of TypeScript, Python, or Go, and the ability to work across a large production codebaseExperience designing, refactoring, and operating complex cloud-native software systemsStrong understanding of application security, including authentication, authorization, input validation, secure API design, multi-tenant systems, and secure SDLC practicesPractical experience with cloud infrastructure on GCP or AWS, including IAM, secrets management, networking, containers, and KubernetesExperience with Infrastructure as Code, preferably Terraform or similar toolsFamiliarity with software supply-chain security: dependency risks, CI/CD hardening, container scanning, build integrity, artifact provenance, and secure release processesPrevious experience in using AI tools to analyze code, detect vulnerabilities, automate reviews, or improve engineering workflowsA collaborative, low-ego approach. You make security something engineers want to adopt, not something they try to work aroundExperience in application security, product security, penetration testing, or red-team exercisesExperience securing AI or agentic systems, including prompt-injection defense, tool sandboxing, model access controls, or AI data-exfiltration risksExperience building internal developer platforms, secure libraries, CI/CD tooling, or engineering automationExperience with SOC 2, ISO 27001, or similar compliance frameworks, especially if you have helped translate compliance needs into automated engineering controlsContributions to open-source security tooling, security research, responsible disclosure, or technical writing on security topicsExperience with geospatial, data platforms, cloud data warehouses, or enterprise SaaS platformsBenefitsAnnual bonus of up to 10% based on company objectivesAccess to our Employee Stock Options PlanPrivate medical insuranceFlexible compensationEducation stipendRemote work stipendEnglish classesCompany OverviewCarto is a platform that turns spatial data into an efficient delivery route, better behavioral marketing, and strategic store placements. It was founded in 2012, and is headquartered in New York, New York, USA, with a workforce of 51-200 employees. Its website is https://www.carto.com.