> Markdown version of [/jobs/ext/3804617-lead-cloud-security-engineer](https://www.wearedevelopers.com/jobs/ext/3804617-lead-cloud-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Cloud Security Engineer - **Company:** Vanguard - **Location:** Malvern, PA, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Microsoft Access, Artificial Intelligence, Amazon Web Services, Amazon S3, Audit Trail, Microsoft Azure, Cloud Computing Security, Configuration Management Databases, Software Quality, Continuous Integration, Extract Transform Load (ETL), Fault Tolerance, Github, Identity and Access Management, JSON, Python (Programming Language), Windows PowerShell, Role-Based Access Control, Power BI, Aws Command Line Interface (CLI), SQL Databases, Tableau (Software), YAML, Datadog, Policy as Code, Data Logging, Software Repository, Google Cloud, Grafana, State Machines, Boto3, Multi-Cloud, Cloudformation, Pyspark, Production Code, Drift Detection, Cloudwatch, Api Gateway, Terraform, Oracle Cloud Infrastructure, Splunk, Api Management, Atlassian Bamboo - **Published:** October 17, 2026 - **Apply:** http://www.vanguardjobs.com/job/24019237/lead-cloud-security-engineer-malvern-pa/?utm_medium=%22mcloud%2Djobads%22&utm_campaign=Technology&utm_content=Lead%20Cloud%20Security%20Engineer&utm_term=183086 ## About the Role We are seeking a senior engineer who can also lead technically - designing, building, and shipping the cloud security controls platform that protects Vanguard's AWS (primary) and multi-cloud environments. You will write production-grade code and infrastructure-as-code to deliver preventive and detective controls - SCPs, permission boundaries, resource and identity policies, posture checks, and event-driven remediation - roll them out safely, own the standards for how they are built and shipped, and raise the engineering bar for the team around you. The ideal candidate pairs deep hands-on engineering with deep cloud expertise and technical leadership, and influences across teams without direct authority. They bring sound security instincts - reasoning about trust boundaries, least privilege, and blast radius. Deep expertise in our specific security and IAM policy frameworks is not required on day one; we are looking for the engineering strength and judgment to master them quickly., * Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred. * Strong hands-on engineering - writes and ships production-grade code (Python or equivalent - production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with CloudFormation day to day (Terraform a plus). * Deep cloud expertise - hands-on experience across at least one of AWS, GCP, or Azure (AWS strongly preferred), at the level of org-wide account structures, landing zones, and cross-account security patterns at scale. * Technical leadership & influence - a track record of leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction across teams without direct authority. * Security judgment - reasons about trust boundaries, least privilege, and blast radius; can threat-model what goes wrong when access is too broad. * Familiarity with AWS IAM policy mechanics - inline, customer-managed, permission boundaries, SCPs, RCPs, and resource/identity policies - is a plus; depth here is learnable on the job. * Experience working directly with engineering teams on policy-as-code, CI/CD integrations, code repositories and pipelines (GitHub or similar), and cloud security tooling. * Experience operating in regulated or audit-driven environments. * Relevant certification (e.g. AWS Security Specialty or a Professional-level AWS certification) is a plus, not required. * Undergraduate degree in a related field or the equivalent combination of training and experience. ## Description * AWS IAM - roles, policies, trust and resource-policy patterns, permission boundaries, SCPs. * CloudFormation (JSON/YAML) - heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits). * Python for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3). * CI/CD pipelines (GitHub Actions, Bamboo, or similar) for building, testing, and shipping controls. * Core AWS at org scale - Organizations, IAM Identity Center, and services such as Lambda, EventBridge, Step Functions, S3, API Gateway, and CloudWatch. Nice to have - or you'll pick up fast * Security-native AWS - Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS. * CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana). * Data skills (SQL and JSON, ETL, Tableau/Power BI). * Multi-cloud exposure (GCP, Azure, OCI). * PowerShell, PySpark, and AI-assisted tooling. Core Responsibilities: Technical Leadership * Lead technical design reviews and own the standards for how controls are built, tested, and shipped - raising the bar on code quality, systems thinking, and operational readiness. * Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff. * Influence engineering patterns and best practices across teams - driving technical direction beyond your immediate team, without direct authority. Solution Design & Delivery * Design enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on - designing for auditability, fault tolerance, and graceful degradation when upstream systems change. * Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts - owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM). * Move fluidly between design and hands-on build; stay close to the code. Automation & Infrastructure as Code * Build preventive and detective controls as code - author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (CloudFormation and/or Terraform) and policy-as-code (Rego/OPA). * Embed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control. * Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate). Security Engineering & Strategy * Engineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale. * Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls. * Translate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness. * Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed.