Senior Cloud Security Engineer

Responsibilities

Own the security posture of cloud environments across AWS, GCP, and Azure. Design secure reference architectures and reusable patterns for account and project structure, network segmentation, encryption, key management, and secrets management. Build security into Infrastructure as Code through hardened modules, policy as code, and pre-deploy checks. Secure CI/CD pipelines and the software supply chain, including permissions, secrets, artifact integrity, and workload identity. Design and enforce least-privilege IAM, federation, role structures, and access reviews across cloud providers. Write code and scripts to automate security controls, remediation, and evidence collection. Operate and tune CSPM and cloud-native security services and drive findings through remediation. Build cloud logging and detection and lead the cloud side of incident response. Contribute security controls and evidence to SOC 2, ISO 27001, and similar compliance programs. Map the cloud footprint during the first 90 days and establish guardrails, centralized logging, posture monitoring, and automated CI/CD security checks.

Requirements

Experience in a DevOps, SRE, or platform engineering role building and operating production infrastructure and CI/CD pipelines. Hands-on production experience securing at least two major cloud providers among AWS, GCP, and Azure. Deep knowledge of cloud security best practices, including CIS Benchmarks and provider security foundations guidance. Knowledge of least-privilege IAM, workload identity, network segmentation, private connectivity, encryption, key management, secrets management, centralized logging, and preventive guardrails. Strong coding and scripting skills in at least one general-purpose language such as Python or Go, plus shell scripting. Hands-on experience with Infrastructure as Code such as Terraform or OpenTofu and embedding security checks into it. Strong communication skills for explaining security risks to engineering teams. Familiarity with tools such as Prowler, Checkov, Trivy, OPA, and Falco is preferred. Container and Kubernetes security experience, including admission control and runtime policy, is preferred. Relevant cloud security certification, SaaS and developer-platform security experience, compliance-program experience, and cloud incident response or forensics experience are preferred.

Benefits

Remote work in North America.