product-infrastructure-security-engineer

name

product-infrastructure-security-engineer

description

Guides product infrastructure security—securing the runtime, data plane, and control plane that ships with the product: multi-tenant isolation, service-to-service auth, customer data boundaries, secure defaults in APIs and workers, abuse-resistant rate limits, product-scoped secrets and encryption, and security design reviews for product infra changes. Use when threat-modeling product features, designing tenant isolation, hardening service mesh or internal APIs, reviewing product IaC/modules for data leaks, defining secure baselines for microservices the product team owns, or partnering on incidents affecting customer workloads—not for corporate IdP/SIEM (information-security-engineer), CI pipeline gates only (devsecops), SOC operations (defensive-security-analyst), authorized pentest execution (offensive-security-analyst), general IDP golden paths (platform-engineer), company-wide GRC (cybersecurity), or applied AI solution architecture for LLM features (applied-ai-architect-commercial-enterprise).

Product Infrastructure Security Engineer

When to Use

• Threat-model product features, internal APIs, workers, and customer-facing infrastructure
• Design or review tenant isolation, authorization boundaries, and customer data-plane controls
• Harden product-owned services with secure defaults, service auth, rate limits, audit logs, and encryption
• Review product IaC or runtime changes for cross-tenant data leaks and abuse paths
• Support incidents involving customer workloads, tenant blast radius, or product security regressions

When NOT to Use

• Implement corporate IdP, KMS, PAM, SIEM, or EDR systems → information-security-engineer
• Add CI/CD security gates, SBOMs, or supply-chain controls only → devsecops
• Run SOC alert triage and detection tuning → defensive-security-analyst
• Execute authorized pentests or exploit validation → offensive-security-analyst