Lead Cloud Security Engineer

• AWS IAM - roles, policies, trust and resource-policy patterns, permission boundaries, SCPs.
• CloudFormation (JSON/YAML) - heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits).
• Python for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3).
• CI/CD pipelines (GitHub Actions, Bamboo, or similar) for building, testing, and shipping controls.
• Core AWS at org scale - Organizations, IAM Identity Center, and services such as Lambda, EventBridge, Step Functions, S3, API Gateway, and CloudWatch.

Nice to have - or you’ll pick up fast

• Security-native AWS - Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS.
• CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana).
• Data skills (SQL and JSON, ETL, Tableau/Power BI).
• Multi-cloud exposure (GCP, Azure, OCI).
• PowerShell, PySpark, and AI-assisted tooling.

Core Responsibilities:

Technical Leadership

• Lead technical design reviews and own the standards for how controls are built, tested, and shipped - raising the bar on code quality, systems thinking, and operational readiness.
• Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff.
• Influence engineering patterns and best practices across teams - driving technical direction beyond your immediate team, without direct authority.

Solution Design & Delivery

• Design enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on - designing for auditability, fault tolerance, and graceful degradation when upstream systems change.
• Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts - owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM).
• Move fluidly between design and hands-on build; stay close to the code.

Automation & Infrastructure as Code

• Build preventive and detective controls as code - author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (CloudFormation and/or Terraform) and policy-as-code (Rego/OPA).
• Embed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control.
• Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate).

Security Engineering & Strategy

• Engineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale.
• Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls.
• Translate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness.
• Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed.

We are seeking a senior engineer who can also lead technically - designing, building, and shipping the cloud security controls platform that protects Vanguard’s AWS (primary) and multi-cloud environments. You will write production-grade code and infrastructure-as-code to deliver preventive and detective controls - SCPs, permission boundaries, resource and identity policies, posture checks, and event-driven remediation - roll them out safely, own the standards for how they are built and shipped, and raise the engineering bar for the team around you. The ideal candidate pairs deep hands-on engineering with deep cloud expertise and technical leadership, and influences across teams without direct authority. They bring sound security instincts - reasoning about trust boundaries, least privilege, and blast radius. Deep expertise in our specific security and IAM policy frameworks is not required on day one; we are looking for the engineering strength and judgment to master them quickly., * Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred.

• Strong hands-on engineering - writes and ships production-grade code (Python or equivalent - production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with CloudFormation day to day (Terraform a plus).
• Deep cloud expertise - hands-on experience across at least one of AWS, GCP, or Azure (AWS strongly preferred), at the level of org-wide account structures, landing zones, and cross-account security patterns at scale.
• Technical leadership & influence - a track record of leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction across teams without direct authority.
• Security judgment - reasons about trust boundaries, least privilege, and blast radius; can threat-model what goes wrong when access is too broad.
• Familiarity with AWS IAM policy mechanics - inline, customer-managed, permission boundaries, SCPs, RCPs, and resource/identity policies - is a plus; depth here is learnable on the job.
• Experience working directly with engineering teams on policy-as-code, CI/CD integrations, code repositories and pipelines (GitHub or similar), and cloud security tooling.
• Experience operating in regulated or audit-driven environments.
• Relevant certification (e.g. AWS Security Specialty or a Professional-level AWS certification) is a plus, not required.
• Undergraduate degree in a related field or the equivalent combination of training and experience.

About Vanguard

At Vanguard, we don’t just have a mission-we’re on a mission.

To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients’ lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.