---
title: 'Senior Platform Security Engineer - Contract to Hire at Front'
canonical: 'https://feeny.ai/job/senior-platform-security-engineer-contract-to-hire-front-san-francisco-5p8at5h32p8p'
type: 'job'
last_seen: '2026-09-06'
---

# Senior Platform Security Engineer - Contract to Hire at Front

- **Company:** Front
- **Location:** San Francisco, CA
- **Compensation:** $187k–$250k
- **Employment:** full-time
- **Posted:** 2026-08-20
- **Last confirmed live:** 2026-09-06
- **Apply:** https://jobs.ashbyhq.com/frontcareers/9376f2fd-b9ac-4090-8a0d-4ea60a3ed4c5

## Job description

Front is the customer operations platform built for B2B complexity, keeping every team, tool, and customer conversation in sync so companies can scale without losing connection. Others handle simple interactions. Front handles the coordination and context behind complex B2B customer relationships. Over 9,000 companies, including Uber Freight, Navan, and Stripe, rely on Front because it's the only one that can run the operational layer that makes customer-facing work actually succeed.

Backed by Sequoia Capital and Salesforce Ventures, Front has raised $204M from leading venture capital firms and independent investors including top executives at Atlassian, Okta, Qualtrics, Zoom, and PagerDuty. Front has received numerous Great Place to Work accolades, including Top Places to Work by USA Today 2025 https://topworkplaces.com/company/front/, Y Combinator's list of Top Companies in 2023 https://www.ycombinator.com/topcompanies, #4 on Fortune’s Best Workplaces in the Bay Area™ https://www.greatplacetowork.com/best-workplaces/bay-area/2022?category=small-and-medium ,Inc. Magazine's 2022 Best Workplaces list https://www.inc.com/best-workplaces/2022, and Forbes Best Startup Employers 2022 List https://www.forbes.com/lists/americas-best-startup-employers/?sh=661411d52ad7.

Front is building a serious amount of software for itself. GTM Engineers are shipping internal tools and AI agents on top of Salesforce, Gong, Snowflake, Workato, Notion and Claude — automations that our revenue teams now depend on to do their jobs.

That software needs somewhere reliable and secure to run. You'll decide how internal software at Front gets built, deployed, secured and operated — the standards, the reference architecture, the review bar — and then you'll implement them yourself and keep them alive as the estate grows. There is no separate team to hand a standards document to. Writing it and building it are the same job.

We're hiring for opinions. If you've built a platform practice from nothing before and have views on what good looks like — where to put the guardrails, which conventions are worth enforcing, what to automate before it becomes a habit — we want to hear them in the interview, not after you start. Strong opinions include knowing when to adopt rather than invent: you'll partner closely with our product engineering org and take what already works there. Your users are other engineers, and your job is measured by how fast and safely they can move.

You'll report into Corporate IT and work day to day alongside the GTM Systems, Data and product engineering teams whose tooling and engineers the platform depends on.

What will you be doing?

Define how we build and run internal software

- Set the standards for internal engineering at Front: how services are structured and deployed, how environments and secrets work, what gets logged, what "production-ready" means for an internal tool. Write them down, and make the documented path the easiest path.
- Partner with our product engineering org and inherit their tooling, patterns and processes wherever they apply to internal platforms. Front already runs production software well — the goal is to extend that foundation to internal systems, not to build a second one. Diverge where internal systems genuinely differ, and be able to say why.
- Define the reference architecture for internal systems and the security requirements every internal tool has to meet before it touches governed data.
- Own the review bar. Decide what needs review, what can ship freely, and be the person who says no when something isn't ready — with a clear reason and a path forward.
- Keep the standards honest as things change. Revisit them when they cause friction, retire the ones that stopped earning their keep, and don't let the documentation drift from what's actually running.
- Bring your own opinions and build consensus for them across GTM Systems, Data, Enterprise Security and Legal. You'll need those teams to adopt what you define, which means persuading rather than mandating.

Own the infrastructure

- Own the cloud infrastructure our internal tools and AI systems run on AWS & Snowflake: compute, networking, data stores, DNS, certificates.
- Define infrastructure as code and get us to the point where nothing meaningful is provisioned by hand. Manage state, modules, and drift.
- Own environments — production, staging and whatever local story we give engineers — and make them consistent enough that "it worked in staging" means something.
- Run the observability stack: metrics, logs, traces and alerting that engineers can self-serve, and that tell you about a problem before a user does.
- Own platform cost. Right-size infrastructure and AI/warehouse consumption, attribute spend to the teams and tools driving it, and flag anomalies before they become finance conversations. [TBD: annual spend under management]

Build the paved road

- Build and maintain CI/CD so GTM Engineers can ship without asking you: pipelines, test and scan gates, deploy and rollback.
- Provide golden paths — templates, base images, shared modules and libraries — so the standard way to build something is also the secure, observable, cost-sane way.
- Own secrets architecture: centralized storage, scoped short-lived credentials, and rotation that happens without a human remembering.
- Reduce toil through automation and self-service. Every request you make unnecessary is worth more than the one you fulfill.

Secure the platform and the code that runs on it

- Own security of the infrastructure and SDLC for internal systems: IaC scanning, container and image hygiene, dependency and supply-chain scanning, secret detection, and CI/CD pipeline hardening.
- Harden cloud configuration against a defined baseline (CIS or equivalent), track drift, and remediate before someone else finds it.
- Run vulnerability management for platform infrastructure and internal application dependencies — scanning, triage, prioritization, patch coordination and verification against agreed SLAs.
- Be the security review on new infrastructure, integrations and AI tooling before they touch governed data, and keep an accurate inventory of what is connected to what.
- Design access and network boundaries so a compromised internal tool has a small blast radius. Enforce least privilege on the infrastructure layer.
- Respond when an incident touches your systems: containment, evidence preservation, and coordination with Enterprise Security, who own corporate detection and incident command.
- Own security monitoring/alerting across platform, integration layer and AI clients; build and tune detections for anomalous query patterns, unusual data egress, off-hours access, privilege escalation.
- Monitor audit logs from AI, Workato and the MCP layer and triaging signal from noise and build automations to trigger alerts.
- Define and implement Data loss prevention controls on paths where governed data leaves — including AI client responses and downstream exports.

Compliance, incident response and RBAC

- Maintain and rehearse incident runbooks and tabletop exercises for named scenarios: leaked credentials, over-broad access grants, prompt-injection data disclosure, third-party integration compromise.
- Assist our GRC team with evidence collection for SOC 2, ISO, and any other relevant compliance frameworks.
- Scope reviews and access audits on a predictable cadence for MCP, Workato and AI client integrations.
- Respond to access requests and access incidents; removing standing access in favor of just-in-time.
- Partner with GTM Systems and Data teams to define access requirements for various data types across systems using RBAC, ABAC, or hybrid access control models.
- Partner with our internal IAM team to implement joiner-mover-leaver (JML) automations and leverage existing access governance tools for periodic access reviews.

AI client layer

- Provide escalation support for troubleshooting MCP and tool integrations with our AI clients (Claude, ChatGPT, Notion, etc.).
- Maintain semantic layer configuration — tool definitions, schema descriptions, semantic views.
- Treat unauthorized exposure through an AI client as a security incident, not a bug.
- Root-causing data quality complaints.

Keep it running, and keep engineers unblocked

- Operate the AI and data plumbing that internal tools consume — Workato recipes, MCP connectors, Snowflake access paths — and absorb upstream API and schema changes without downstream teams noticing.
- Serve as escalation point for platform problems, with clear triage, communication and resolution.
- Participate in on-call [TBD: confirm a rotation exists and who else is in it], and write postmortems with owned, dated follow-ups that you close out.
- Maintain runbooks and architecture documentation so the platform is operable and defensible by more than one person.
- Review other engineers' infrastructure and deployment changes, and raise the bar through that review.

What skills and experience do you need?

Required

- You've established a platform, DevOps or infrastructure practice somewhere it didn't exist — as a founding platform engineer, an early infra hire, or the person who dragged a team onto real standards. You can point at conventions still in use that you wrote.
- Deep hands-on experience running production infrastructure in a major cloud — networking, IAM, compute, and the failure modes of each.
- Infrastructure as code in production at scale: Terraform, Pulumi, CloudFormation or equivalent, including inheriting and refactoring someone else's modules.
- Owning CI/CD pipelines end to end, including test, scan and deploy gates. Containers and orchestration.
- Strong Python or Go for automation, tooling and debugging systems you didn't write.
- Practical infrastructure security: cloud configuration hardening, secrets management, dependency and vulnerability management, and least-privilege access design.
- Clear written communication, and the judgment to know when a standard should be enforced in a pipeline versus argued in a room. You'll be writing documentation engineers actually use and explaining risk to non-technical stakeholders.
- Strong SQL experience, ability to write queries within Snowflake and other BI tools.
- Hands-on security operations experience: log and audit analysis, alert triage, real incident response. Experience reviewing events within a SIEM.
- Experience with implementing and managing SAML/OIDC SSO and SCIM on internal-built tools and integrating such tools with identity providers such as Okta.
- Strong experience with secrets management, including OAuth, API, and JWT service account based integrations.
- Production iPaaS experience including repairing integrations you didn't write.
- Bias towards documentation — if you do something, write it down for others to reference.

## Nice to have

- Experience building an internal developer platform, or otherwise being on the team whose customers are other engineers.
- Experience operating LLM or agent infrastructure in production — MCP servers, RAG pipelines, semantic layers, or AI tooling connected to enterprise data.
- Familiarity with AI-specific security risks: prompt injection, tool-use abuse, data leakage through model context, and the controls that mitigate them.
- iPaaS or orchestration experience: Workato, Airflow, dbt, MuleSoft or similar.
- Detection engineering or SIEM exposure (Splunk, Panther, Datadog Security or similar).
- Snowflake or comparable cloud data warehouse operations, including cost and performance tuning.
- Background/experience supporting a GTM or revenue organization.
- Gong, HubSpot, Outreach or similar GTM tooling and their data models.
- Master data management, entity resolution, customer data platforms.
- Comfortable with pipeline, ARR and product-adoption metrics.

What this role is not

- This is not primarily an internal tools building role. GTM Engineers build the tools. You build and secure what they run on. You'll write plenty of code — it's infrastructure, tooling and automation code.
- This is not a customer-facing product role. You won't be working on the Front product or its production infrastructure.
- This is not a research or model-training role. You won't be fine-tuning models or publishing papers.
- This is not a standards-on-paper role. You'll define the practices, but you also build them, enforce them in the pipeline, and operate what you've built. If you're looking for architecture or GRC work that hands off to an implementation team, this isn't it — there is no implementation team.
- This is not a role where you inherit someone else's playbook. We're not asking you to follow our standards. We're asking you to write them.

## How we'll measure success

- First 30 days
- You've mapped the estate: what runs where, who can reach it, what's provisioned by hand, and where the sharpest edges are.
- You've told us what you think is wrong with it and what you'd do differently.
- First 90 days
- A first version of our internal platform standards exists, is written down, and has buy-in from the teams who have to follow it.
- You've closed the top three risks you found.
- Core infrastructure is defined in code, secrets are centralized with a rotation cadence, and a GTM Engineer can deploy a new internal tool through a documented path without your involvement.

Contractors have the option to work from our office on Tuesdays, Wednesdays, and Thursdays, when our teams are onsite. In-office attendance is optional and not required for this role.

Front provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age or disability. By applying, you acknowledge and agree that you have read and understand the California Recruiting Privacy Notice https://front.com/legal/california-recruiting-privacy-notice & EU Privacy Notice https://front.com/legal/eu-recruiting-privacy-notice

## About Front

## Company Overview
- **One-liner**: Front is a customer operations platform that unifies teams, tools, and AI into a single system for B2B companies handling complex, high-stakes customer conversations.
- **Entity Type**: Private (venture-funded, Series? Not explicitly stated but $204M total funding)
- **Headquarters**: San Francisco, California, USA
- **Founded**: 2013
- **Founders**: Mathilde Collin (Co-founder & Executive Chair), Laurent Perrin (Co-founder & CTO)

## Core Business
- **Primary industry**: Customer service / customer operations software (Shared inbox, AI automation, workflow orchestration)
- **Target customers**: B2B teams dealing with complex, multi-stakeholder customer interactions – including Customer Support, Account Management, Customer Success, and Inbound Sales. Served 9,300+ businesses worldwide.
- **Mission**: "Keep every team, tool, and customer conversation in sync so companies can scale without losing connection."

## Products & Services
- **Front AI (AI Command Center)**: AI-powered automation that handles complex requests (not just simple FAQs) – including automated responses, agent assistance, and quality analysis across the entire customer operation.
- **Shared Inbox**: Collaborative inbox where teams can assign, comment, route, and manage customer conversations across email, text, chat, and other channels from a single view.
- **Integrations (130+)**: No-code connections with popular business tools (e.g., Slack, Salesforce, Jira, etc.) to bring full context into every conversation.
- **Multi-step Workflows**: Automated workflows for routing, escalation, and cross-department handoffs.

## Market Standing
- **Valuation**: Not publicly disclosed
- **Key Metric**: Surpassed $100M in Annual Recurring Revenue (ARR) in 2025
- **Total Funding**: $204M in venture funding from **Sequoia Capital**, **Salesforce Ventures**, and **Battery Ventures**
- **Growth Signals**: 300+ employees across 5 offices (San Francisco, Paris, Dublin, Chicago, Santiago); 9,300+ customers; 4.7 stars / 2,000+ reviews on G2; repositioned around AI in 2025; new CEO Dan O'Connell (ex-Dialpad) driving growth past $100M ARR

## Competitive Advantages
- Ten years of building a platform purpose‑built for complex, multi‑team customer operations (not simple ticketing)
- AI trained on collaboration patterns from a decade of real‑world usage, enabling deeper automation than competitors that only handle FAQ‑style tickets
- Unified view across support, success, sales, and account management – eliminating the "coordination tax" of switching tools
- Deep integration ecosystem (130+) and no‑code workflow builder that adapts to each customer's unique processes

## Strategic Focus
- **AI‑first transformation**: Using Front AI to handle complex requests autonomously and assist human agents
- **Scaling operations**: Continuing to grow ARR while maintaining capital‑efficient growth (CFO Meredith Finn from Salesforce Ventures/Twitter)
- **Market positioning**: Emphasizing differentiation from Zendesk and other legacy tools by owning the "complex operations" segment
- **Global expansion**: Offices in Europe (Paris, Dublin) and Latin America (Santiago) alongside US hubs

## Why Work Here
- **Culture**: Values include Transparency, Speed, Low Ego, Care, High Standards, and Collaboration. Employees describe an environment where "everyone is empowered to take ownership" and "low‑ego culture" is prioritized.
- **Remote & Hybrid**: Remote work is supported (team members in Portland, Phoenix, Australia, Argentina, etc.), though there are offices in SF, Paris, Dublin, Chicago, and Santiago. Many roles are location‑specific.
- **Benefits**: Competitive compensation, flexible time off, healthcare (premiums covered), 401(k)/pension, parental leave, wellness benefits, commuter benefits, volunteer time off.
- **Engineering & Product**: Open roles include AI Engineering Manager, Senior Software Engineers (Frontend, Backend, Mobile/React Native), Product Managers, and a Director of Product Design – indicating strong investment in core platform and AI.
- **Team size**: 300+ employees with a flat, cross‑functional structure; emphasis on collaboration and moving fast.

## Sources
1. [front.com/about](https://front.com/about)
2. [front.com/jobs](https://front.com/jobs)
3. [front.com/](https://front.com/)
4. [linkedin.com/company/fronthq](https://www.linkedin.com/company/fronthq)
5. [crunchbase.com/organization/front-app](https://www.crunchbase.com/organization/front-app)

## Other roles at Front

- [Senior Implementation Manager](https://feeny.ai/job/senior-implementation-manager-front-chicago-pm2b8dcybpyp) — Chicago, IL
- [Senior Implementation Manager](https://feeny.ai/job/senior-implementation-manager-front-san-francisco-qpsp935g321x) — San Francisco, CA
- [Full Stack Engineer - Integrations](https://feeny.ai/job/full-stack-engineer-integrations-front-santiago-st9h1j6563x3) — Santiago, Chile
- [Senior Account Executive, EMEA](https://feeny.ai/job/senior-account-executive-emea-front-dublin-p1tmmzqwrcfx) — Dublin, Ireland
- [Director, Account Management](https://feeny.ai/job/director-account-management-front-san-francisco-1chh2xwwaw8v) — San Francisco, CA
- [Director, Account Management](https://feeny.ai/job/director-account-management-front-chicago-dy0t73w1a6h0) — Chicago, IL
- [Software Engineering Intern - Spring/Summer 2027](https://feeny.ai/job/software-engineering-intern-spring-summer-2027-front-paris-xa30byehaftv) — Paris, France
- [Senior Solutions Engineer](https://feeny.ai/job/senior-solutions-engineer-front-san-francisco-5nb8zsvk2ccw) — San Francisco, CA
- [Software Engineer, Core Product](https://feeny.ai/job/software-engineer-core-product-front-san-francisco-r4131xx51vhj) — San Francisco, CA
- [Senior Software Engineer (Backend), Deliverability](https://feeny.ai/job/senior-software-engineer-backend-deliverability-front-san-francisco-qk240kr6dr2m) — San Francisco, CA