Polymarket

Role Description Polymarket is hiring a Cloud Security Engineer to own the security posture of our AWS environment. You'll be embedded in our engineering and security teams, designing and enforcing security controls directly in infrastructure code, building guardrails that scale with the product, and reducing risk without slowing down engineering velocity. This role is hands-on and highly cross-functional. You'll work closely with DevOps, Platform, and Application Engineering to make secure-by-default the path of least resistance. - Own and continuously improve Polymarket's AWS security posture across accounts, regions, and services — including IAM policies, SCPs, VPC segmentation, and account-level security baselines - Review and contribute to IaC modules that encode security defaults; integrate automated security checks into the deployment pipeline including policy-as-code validation and misconfiguration scanning - Own cloud-side security telemetry: CloudTrail, GuardDuty, Security Hub, Config Rules, VPC Flow Logs, and S3 access logging - Develop and tune detection logic for cloud-specific threats; partner with the SOC team on alert fidelity, incident response runbooks, and AWS-level investigations - Govern secrets management using AWS Secrets Manager and SSM Parameter Store; manage KMS key policies, rotation, and envelope encryption patterns - Drive remediation of findings from AWS Inspector, Security Hub, and third-party CSPM tooling; maintain benchmarks aligned to CIS AWS Foundations - Support audit and compliance activities (SOC 2, PCI-DSS, or similar) and conduct regular access reviews to identify and remediate privilege creep Qualifications - 4+ years of experience in cloud security, cloud engineering, or a security-focused infrastructure role - Deep, hands-on expertise with AWS security services: IAM, SCP, GuardDuty, Security Hub, CloudTrail, Config, KMS, WAF, Inspector, and VPC - Hands-on experience writing infrastructure as code (Pulumi, Terraform, CDK, or equivalent) with a security-first mindset - Strong understanding of AWS networking and how misconfigurations translate to real attack surface - Proficiency in at least one scripting or programming language (Python, TypeScript, or Go) for automation and tooling - Ability to evaluate architectural decisions for security risk and communicate findings clearly to engineering peers - (Plus) Familiarity with Pulumi, specifically TypeScript-based stacks - (Plus) Familiarity with Web3, blockchain infrastructure, or crypto-sector threat models - (Plus) Experience securing containerized workloads on ECS or EKS, including image scanning and runtime security - (Plus) AWS certifications: Security Specialty, Solutions Architect — Professional, or equivalent - (Plus) Exposure to SOC 2 Type II or PCI-DSS cloud control requirements Benefits - Competitive salary & equity - Unlimited PTO - Full Health, Vision, & Dental coverage - 401k match - Hardware setup: new MacBook Pro, big display, & accessories

• Own technical onboarding for market makers and institutional partners end to end, from first API call to live trading, across our CLOB, WebSocket feeds, and RFQ gateway. • Serve as the primary technical contact post-onboarding, triaging issues, debugging integrations in production, and coordinating with engineering on fixes. • Write and maintain integration guides, code samples, and SDK documentation that reduce time-to-live for new partners. • Monitor the health of active partner integrations proactively and surface issues before partners report them. • Translate partner feedback, including bugs, missing features, and API pain points, into clear, actionable input for product and engineering. • Build and maintain code samples in Python and TypeScript that partners can actually use, not just reference. • Act as the technical bridge between trading firms and internal engineering, explaining complex system behavior clearly to both sides.

• Evaluate the existing DCO clearing environment and identify what needs to be built, improved, or replaced to support scale • Own clearing-related SOPs, runbooks, escalation paths, and internal documentation — if a process doesn't have a document, you write it; if it's outdated, you fix it • Partner daily with Control Desk, Clearinghouse, DCM, DCO, Finance, Treasury, Compliance, Product, Engineering, the ISV team, and CX to keep clearing operations running and drive improvements across all touch points • Serve as the operational thought leader for client-facing process quality — translate user pain points into process improvements and SLA enhancements, and close the loop between what clients experience and how the back office operates • Support treasury management, cash movement, reconciliation, settlement, and liquidity workflows; understand where the money is at every point in the lifecycle • Define and operate within SLAs — where they don't yet exist, propose them, document them, and hold the organization to them • Identify operational gaps, control weaknesses, and tooling deficiencies; bring problems forward with proposed solutions, not just observations • Partner with Product and Engineering to build and improve clearing tools, exception management workflows, dashboards, and operational controls • Support issue triage and resolution across clearing, settlement, treasury, and exchange operations — stay calm when things go sideways and move quickly to resolve

• Own core exchange backend systems. Take deep ownership of the systems that power order matching, position management, and order state across perpetual futures. • Build and optimize the matching engine. Profile hot paths, reduce lock contention, and drive improvements to latency and throughput backed by benchmarks and production-grade evidence. • Design for correctness at scale. Build queueing and backpressure mechanisms that keep the orderbook consistent and reliable under high load, without crossing books, creating ghost fills, or introducing stale order state. • Build for observability. Instrument systems with metrics, logs, and traces. Establish rollback guarantees and narrow critical paths that make production incidents faster to detect, diagnose, and resolve. • Improve runtime performance. Optimize CPU, memory, and allocation behavior to meet the demands of a high-throughput exchange in production. • Own production incidents end-to-end. Debug latency and correctness issues directly, and drive follow-through that leaves the system measurably better each time.

• Build the risk framework. Define and own the parameters that will govern how the exchange operates: max open interest, position size limits, leverage tiers, and margin requirements across account types. • Design liquidation and insurance fund protocols. Establish the processes and infrastructure for managing liquidations and offloading risk through hedging or counterparty relationships when needed. • Build risk monitoring infrastructure. Design the systems and tooling that will give the team continuous visibility into account health, exposure concentration, and exchange solvency. • Establish operating protocols. Define the playbooks for how the team responds to stressed market conditions, large position buildups, and potential exchange dislocations. • Build your own tooling. Use Python, SQL, or whatever you need to build internal tools for evaluating risk and staying ahead of developing exposures.

• Drive awareness and adoption of Polymarket within student and early-career communities • Create content that translates markets, events, and probabilities for a broader audience • Lead local programming — campus events, meetups, partnerships, and community-building • Surface trends, narratives, and market opportunities

• Own customer experience coverage across the ticketing system and monitor community and social channels during your shift • Handle complex and escalated tickets including market resolution disputes, withdrawal and funding issues, KYC follow-ups, and account access problems • Route tickets into the right internal specialty teams with clean tagging and proper PII handling • Hold the line during high-traffic market events — sports finals, elections, breaking news — with on-call awareness during shoulder hours • Draft macros and response templates for recurring issues and produce clean handoffs to the rest of the team • Stay inside approved customer language guidelines at all times — this is a regulated environment and tone matters

• Own the CLOB engine's critical path. Profile matching and orderbook hot paths, map settlement-sensitive state transitions, and drive improvements to latency, throughput, and async engine flow backed by benchmarks and production-grade evidence. • Reduce lock contention without breaking correctness. Debug concurrency issues, design safer queueing and backpressure for orderbooks, and improve the system's ability to handle materially more markets and order flow with lower tail latency. • Build for observability and safety. Instrument improvements with pprof, metrics, logs, and traces. Establish rollback guarantees and narrower critical paths that make production incidents easier to detect, diagnose, and resolve. • Reason about settlement risk. Understand how on-chain transaction effects ripple into off-chain exchange state, and design systems that handle crossed books, ghost fills, stale orders, cancel inconsistencies, and settlement edge cases correctly. • Improve the runtime. Reduce GC pressure, optimize CPU and memory allocation behavior, and push Go runtime performance to meet the demands of a high-throughput exchange at scale. • Debug production incidents. Own latency, correctness, and settlement-state incidents end-to-end, and drive follow-through that leaves the system measurably better each time.

• Own the full helpdesk lifecycle: intake, triage, prioritization, resolution, and closure of all support tickets; establish and enforce SLA targets • Provide white-glove, concierge-level support to executives and senior leadership • Troubleshoot and resolve hardware, software, and network-layer issues — LAN/WAN, DNS/DHCP, VPN, Wi-Fi, macOS/Windows, and peripheral failures • Administer user accounts, access provisioning, and endpoint management via MDM (Kandji, Okta, Intune) • Support onboarding and offboarding workflows including device imaging and account setup • Maintain and improve internal IT documentation, runbooks, and knowledge base articles • Manage hardware and software inventory; coordinate procurement and vendor relationships • Collaborate with engineering and infrastructure teams on escalated issues and cross-functional projects

• Own and continuously improve Polymarket's AWS security posture across accounts, regions, and services — including IAM policies, SCPs, VPC segmentation, and account-level security baselines • Review and contribute to IaC modules that encode security defaults; integrate automated security checks into the deployment pipeline including policy-as-code validation and misconfiguration scanning • Own cloud-side security telemetry: CloudTrail, GuardDuty, Security Hub, Config Rules, VPC Flow Logs, and S3 access logging • Develop and tune detection logic for cloud-specific threats; partner with the SOC team on alert fidelity, incident response runbooks, and AWS-level investigations • Govern secrets management using AWS Secrets Manager and SSM Parameter Store; manage KMS key policies, rotation, and envelope encryption patterns • Drive remediation of findings from AWS Inspector, Security Hub, and third-party CSPM tooling; maintain benchmarks aligned to CIS AWS Foundations • Support audit and compliance activities (SOC 2, PCI-DSS, or similar) and conduct regular access reviews to identify and remediate privilege creep