Senior Cloud Security Engineer

The Senior Cloud Security Engineer is a hands-on technical lead responsible for designing, implementing, and improving security across the organization’s Microsoft Azure and Amazon Web Services (AWS) environments. This role partners with cloud platform, infrastructure, application, identity, and security operations teams to build secure cloud foundations, protect workloads and data, and make security controls repeatable through automation.

The ideal candidate combines deep practical knowledge of Azure and AWS security services with strong skills in cloud architecture, identity and access management, network security, detection and response, and infrastructure as code. Experience with Oracle Cloud Infrastructure (OCI) is a plus.

Key Responsibilities

Cloud Security Architecture and Engineering

Design and implement secure architectures for Azure and AWS environments, including landing zones, accounts and subscriptions, networking, shared services, and workload environments.

Establish cloud security reference architectures, patterns, guardrails, and configuration standards that support secure, reliable, and scalable services.

Review cloud designs and changes for security risks, recommending pragmatic mitigations that fit business and operational needs.

Apply defense-in-depth principles across cloud identity, network, compute, storage, data, application, and management planes.

Help teams adopt secure cloud-native services and architecture patterns while minimizing unnecessary complexity and operational friction.

Identity and Access Management

Design and improve cloud identity and access controls, including least-privilege roles, federation, privileged access, service identities, and workload authentication.

Strengthen identity lifecycle, access review, and administrative access practices across Microsoft Entra ID, Azure, AWS IAM, and related identity providers.

Reduce reliance on long-lived credentials through managed identities, workload identity federation, role assumption, and secure secrets management.

Review policies and permissions for excessive privilege, unintended trust relationships, and cross-account or cross-tenant access risks.

Partner with identity teams to improve conditional access, multifactor authentication, privileged access management, and identity threat monitoring.

Cloud Platform and Workload Security

Secure cloud infrastructure and workloads, including virtual machines, containers, Kubernetes, serverless services, storage, databases, and managed platform services.

Establish and maintain secure baseline configurations, configuration policies, and preventive controls for Azure and AWS.

Implement cloud network security controls such as segmentation, routing safeguards, firewalls, private connectivity, egress controls, and protection of public-facing services.

Improve encryption and key management practices for data at rest and in transit, including certificate management and key lifecycle controls.

Help teams protect sensitive data through classification-aware controls, secure storage configuration, backup protection, and data access governance.

Support vulnerability management for cloud workloads, images, packages, and exposed services, using risk-based prioritization and clear ownership.

Infrastructure as Code and Automation

Embed security controls into infrastructure-as-code workflows using tools such as Terraform, Bicep, CloudFormation, or equivalent technologies.

Develop reusable policy-as-code, templates, modules, and automated checks that make secure configurations easier to adopt.

Integrate security validation into CI/CD pipelines, including configuration analysis, secrets detection, image scanning, and deployment policy checks.

Automate cloud security operations and evidence collection using scripts, APIs, and cloud-native services.

Review automation for secure handling of credentials, permissions, state files, logs, and deployment identities.

Monitoring, Detection, and Incident Response

Improve cloud security visibility, logging, alerting, and detection across Azure and AWS environments.

Configure and optimize cloud-native security and monitoring capabilities, such as Microsoft Defender for Cloud, Microsoft Sentinel, AWS Security Hub, Amazon GuardDuty, AWS Config, and CloudTrail, as appropriate to the environment.

Develop and tune detections for suspicious identity activity, risky configuration changes, anomalous access, exposed resources, and cloud control-plane threats.

Partner with security operations and incident response teams to investigate cloud security events and improve response playbooks.

Ensure critical logs are enabled, protected, retained, and accessible for investigation and compliance needs.

Participate in cloud incident response, root-cause analysis, and follow-up remediation.

Governance, Risk, and Compliance

Define cloud security policies, control objectives, configuration standards, and exception processes.

Assess cloud environments against recognized security frameworks and organizational requirements; track gaps through remediation.

Support audit, regulatory, customer assurance, and risk assessment activities with accurate technical evidence.

Maintain cloud asset, ownership, and risk visibility in partnership with platform and service teams.

Evaluate cloud services and design changes for data residency, privacy, resilience, and shared-responsibility implications.

Communicate cloud risks and mitigation options clearly to engineers, service owners, and leadership.

Collaboration and Enablement

Partner with cloud platform, infrastructure, application engineering, data, identity, and security operations teams to solve security problems collaboratively.

Provide clear, actionable guidance and coach teams on secure cloud design and operational practices.

Document architectures, standards, implementation guidance, and operational procedures.

Mentor other engineers and contribute to a culture of security ownership and continuous improvement.

Core Competencies

Azure and AWS security architecture

Cloud identity and access management

Cloud networking and workload security

Infrastructure as code and security automation

Cloud logging, detection, and incident response

Vulnerability and configuration risk management

Secure cloud governance and compliance

Cross-functional technical leadership

Clear documentation and stakeholder communication

• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, Engineering, or a related field, or equivalent practical experience.
• 7+ of experience in cloud security, cloud engineering, infrastructure security, security engineering, or a closely related discipline.
• Demonstrated hands-on security engineering experience with both Microsoft Azure and AWS.
• Strong understanding of cloud identity and access management, including Azure RBAC, Microsoft Entra ID, AWS IAM, federation, privileged access, and workload identities.
• Experience designing or securing cloud networking, including segmentation, private connectivity, firewalls, routing, DNS, and internet exposure controls.
• Experience securing cloud compute, storage, databases, containers, Kubernetes, and/or serverless workloads.
• Practical experience with infrastructure as code and automated cloud deployment workflows.
• Experience with cloud logging, monitoring, security posture management, vulnerability management, and incident response.
• Understanding of encryption, key management, secrets management, certificate management, and data protection in cloud environments.
• Experience in scripting or automating using languages such as Python, PowerShell, Bash, or similar.., * Experience with Oracle Cloud Infrastructure (OCI) security architecture, identity, networking, logging, or governance.
• Relevant certifications such as Microsoft Certified: Cybersecurity Architect Expert, Azure Security Engineer Associate, AWS Certified Security - Specialty, AWS Certified Solutions Architect, CCSP, CISSP, or equivalent.
• Experience with Microsoft Defender for Cloud, Microsoft Sentinel, AWS Security Hub, Amazon GuardDuty, AWS Config, or comparable cloud security platforms.
• Experience with Terraform, Bicep, CloudFormation, Open Policy Agent, Checkov, or other infrastructure-as-code and policy-as-code tools.
• Experience securing Kubernetes and container platforms, including managed cloud services such as AKS and EKS.
• Experience supporting multi-account, multi-subscription, multi-region, or hybrid cloud environments.
• Familiarity with frameworks and standards such as NIST CSF, NIST SP 800-53, CIS Benchmarks, ISO 27001, SOC 2, PCI DSS, or applicable industry requirements.
• Experience with cloud detection engineering, threat modeling, or cloud incident response.
• Experience applying zero-trust principles to cloud workloads and administrative access.

The pay range below is for Bay Area California only. Actual salary may vary based on a number of factors including job location, job-related knowledge, skills, experiences, trainings, etc. We also offer incentive opportunities that reward employees based on individual and company performance.

$149,100 - $215,925 USD

We use artificial intelligence to screen, assess, or select applicants for the position. Applicants must be eligible for any required U.S. export authorizations.