Lead Cloud Security Engineer

The stack you'll work with:Core — Hands-on day oneAWS IAM — roles, policies, trust and resource-policy patterns, permission boundaries, SCPs.CloudFormation (JSON/YAML) — heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits).Python for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3).CI/CD pipelines (GitHub Actions, Bamboo, or similar) for building, testing, and shipping controls.Core AWS at org scale — Organizations, IAM Identity Center, and services such as Lambda, EventBridge, Step Functions, S3, API Gateway, and CloudWatch.Nice to have — or you'll pick up fastSecurity-native AWS — Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS.CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana).Data skills (SQL and JSON, ETL, Tableau/Power BI).Multi-cloud exposure (GCP, Azure, OCI).PowerShell, PySpark, and AI-assisted tooling.Core Responsibilities:Technical LeadershipLead technical design reviews and own the standards for how controls are built, tested, and shipped — raising the bar on code quality, systems thinking, and operational readiness.Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff.Influence engineering patterns and best practices across teams — driving technical direction beyond your immediate team, without direct authority.Solution Design & DeliveryDesign enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on — designing for auditability, fault tolerance, and graceful degradation when upstream systems change.Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts — owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM).Move fluidly between design and hands-on build; stay close to the code.Automation & Infrastructure as CodeBuild preventive and detective controls as code — author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (CloudFormation and/or Terraform) and policy-as-code (Rego/OPA).Embed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control.Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate).Security Engineering & StrategyEngineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale.Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls.Translate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness.Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed.Qualifications:Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred.Strong hands-on engineering — writes and ships production-grade code (Python or equivalent — production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with CloudFormation day to day (Terraform a plus).Deep cloud expertise — hands-on experience across at least one of AWS, GCP, or Azure (AWS strongly preferred), at the level of org-wide account structures, landing zones, and cross-account security patterns at scale.Technical leadership & influence — a track record of leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction across teams without direct authority.Security judgment — reasons about trust boundaries, least privilege, and blast radius; can threat-model what goes wrong when access is too broad.Familiarity with AWS IAM policy mechanics — inline, customer-managed, permission boundaries, SCPs, RCPs, and resource/identity policies — is a plus; depth here is learnable on the job.Experience working directly with engineering teams on policy-as-code, CI/CD integrations, code repositories and pipelines (GitHub or similar), and cloud security tooling.Experience operating in regulated or audit-driven environments.Relevant certification (e.g. AWS Security Specialty or a Professional-level AWS certification) is a plus, not required.Undergraduate degree in a related field or the equivalent combination of training and experience.Why This Role Matters:This role is central to reducing enterprise risk, enabling secure cloud adoption, and operationalizing cloud security strategy through engineering. Success is measured by technical coverage, control effectiveness, and platform trust. You will directly shape how cloud security controls are designed, built, and adopted across Vanguard.Special FactorsSponsorshipVanguard is not offering visa sponsorship for this position.About VanguardAt Vanguard, we don't just have a mission—we're on a mission.To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.How We WorkVanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.SummaryLocation: Malvern, PA; Charlotte, NC; Dallas/Ft. Worth, TXType: Full time