Problem
Infrastructure changes submitted through GitHub pull requests can silently introduce security risks: widened IAM permissions, public exposure, destructive replacements. Reviewers rarely have time to read a full Terraform plan.
Open role / DevOps Engineer
Security review for infrastructure changes, before they merge.
Wayne Citadel builds a pull-request security review tool for Terraform and OpenTofu on AWS. It runs in GitHub Actions and tells reviewers what a change does to security, in language they can act on.
Start application
About 30 minutes. One written design answer at the end.
pull request #128terraform plan
# the change
aws_security_group.bastion
- cidr_blocks = ["10.0.0.0/16"]
+ cidr_blocks = ["0.0.0.0/0"]
# deterministic analyzer: the facts
finding public SSH configuration
severity high
# grounded explanation: validated against the facts
This rule permits any IPv4 source to attempt TCP/22.What we are building
Constraint
Explain only the change, never scan the whole state. The AI must never decide what a finding is or how severe it is. Those decisions stay with deterministic logic. Nothing in the output may be invented.
Decision
Detection is separate from explanation. A deterministic analyzer produces findings as facts. A grounded language-model layer turns them into a readable impact explanation, validated against the input facts before it is published to the pull request as a comment and as SARIF.
Where you would work
- CI for the project: the fixture library of recorded plan changes, golden-file tests and the model evaluation set.
- AWS test accounts, provisioned with Terraform or OpenTofu, where plan fixtures are recorded.
- Releases of the GitHub Action that customers pin: versioning, signing, provenance and rollback.
Early
The project is at an early stage. Much of it is still to be built.
~16
People on the team right now.
Paid role
This is a paid role. The budget is still being negotiated, so we cannot give you a number yet. We would rather say that up front.