Information Systems Security Engineer

About the role

At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done.

INFORMATION SYSTEMS SECURITY ENGINEER (PRINCIPAL)

ABOUT THE ROLE

Snowflake's national security deployments are authorized to operate inside classified environments, and each authorization stands or falls on the security documentation behind it. This role owns that documentation. You assess the system against its security control baseline, assemble the evidence the authorizing official reviews, and you are accountable for the package getting to authorization on schedule.

Arc Reactor, a classified deployment for a US government customer, is the immediate assignment. The same work will apply to the deployments that follow it.

WHAT YOU WILL DO

- Lead the security control assessment for an assigned deployment, from control selection and tailoring through the body of evidence to authorization.

- Produce the assessment plan, the evidence collection schedule and the residual risk that goes to the authorizing official, and keep them current.

- Direct the engineers and security staff producing control artifacts. Tell them which evidence to collect, review what they produce, and catch gaps in the requirements before they surface during assessment.

- Be the person who can explain a Snowflake control implementation to a government security reviewer, and explain a reviewer's finding back to the engineering team in terms they can act on.

- Track authorization status and blockers, and report them weekly to the engineering lead and the program.

WHAT YOU BRING

- You have taken at least one system through authorization to operate under a government security control framework (NIST 800-53 / RMF, FedRAMP, or the DoD RMF and its Impact Levels), and you can point to the package you were responsible for.

- You can read an engineering implementation and decide which control it satisfies and what evidence it produces.

- You have worked with government authorizing officials or security control assessors, and you know what they reject and why.

- You write the plan down. Assessment scope, control status, evidence gaps and residual risk live in a document the team can run without you, not in your head.

- You are eligible for TS/SCI with a full-scope polygraph, or already hold it.