Cloud Security Engineer

Responsibilities

• Design and operate AWS commercial and GovCloud security posture, including IAM, KMS, VPC segmentation, network controls, and secure-by-default guardrails.
• Build and tune threat detections, conduct threat hunting, operationalize threat intelligence, and turn findings into automated security coverage.
• Architect and administer centralized logging, SIEM, monitoring, alerting pipelines, dashboards, metrics, and security reporting.
• Implement and improve CSPM, vulnerability management, secrets management, endpoint and workload protection, and cloud-native security tooling.
• Secure application development and CI/CD pipelines through GitHub Actions, SAST/DAST/SCA, secrets hygiene, containers, and Kubernetes controls.
• Build version-controlled security guardrails with Terraform, policy-as-code, and containerization.
• Implement and evidence controls for SOC 2, ITAR, GovCloud, and related compliance requirements.
• Support detection, investigation, containment, incident response, and post-incident hardening.

Requirements

• 5+ years of hands-on experience in security engineering, cloud security, or DevSecOps with production ownership of security controls and infrastructure.
• Bachelor's degree in Computer Science or a related field, or equivalent practical experience.
• Deep hands-on AWS security experience across IAM, KMS, VPC/network security, GuardDuty, Security Hub, CloudTrail, Config, WAF, and commercial and GovCloud environments.
• Experience with threat detection, threat hunting, detection engineering, detection-as-code, threat intelligence, centralized logging, SIEM, alerting, dashboards, and security metrics.
• Experience implementing security infrastructure including CSPM, vulnerability management, secrets management, and workload or endpoint protection.
• Experience securing CI/CD pipelines, GitHub Actions, SAST/DAST/SCA integrations, containerized workloads, and Kubernetes.
• Proficiency with Terraform and containerization tools such as Docker for security guardrails and controls.
• Strong systems thinking, adversarial mindset, automation ability, written and verbal communication, and comfort working autonomously.
• Preferred qualifications include AWS Security Specialty, CISSP, OSCP, GCIH, GCIA, or GCFA certification; DuploCloud experience; SOC 2, FedRAMP, ITAR, or CMMC knowledge; regulated deployment experience; incident response, digital forensics, or purple-team experience; and familiarity with listed observability, event-driven, PostgreSQL, and Kubernetes technologies.

Benefits

• Expected annual base pay is $150,000-$160,000, with eligibility for bonus opportunities.
• Hybrid role based in Los Angeles, California, with three days per week in the office; remote work is not available.
• Regular permanent employment.
• Benefits include medical, health savings account, dental, vision, flexible spending accounts, pre-tax commuter benefits, life insurance, AD&D, pet insurance, long-term disability, short-term medical benefits, paid sick time, paid holidays, accrued paid vacation, and employee resource groups.