Cloud Security Engineer

• Find security issues across cloud and data platforms using posture assessments, reviews, and tools such as Wiz, then work with the owning teams to fix them and track each finding to closure.
• Act as the SME for cloud security, setting the standards and reference patterns that engineering and data teams follow.
• Define and implement security controls for AI tooling and platforms in the cloud, such as Amazon Bedrock, AI coding assistants, agent runtimes, and MCP integrations, covering model and data access, credentials and secrets, logging and monitoring, and guardrails.
• Define and promote secure-by-default patterns for AWS, covering account structure, identity, networking, encryption, and logging, and extend them to Azure and Google Cloud Platform.
• Harden containerized workloads on Amazon EKS and Kubernetes, setting guardrails for cluster configuration, workload identity, network policy, and container image and runtime security.
• Work with engineering and operations teams on architecture and design reviews and threat modeling for new and changing systems, mainly on AWS with some Azure and Google Cloud Platform.
• Design secure cross-platform integrations among AWS, Azure, Google Cloud Platform, Snowflake, and Databricks, including identity federation, private connectivity, data sharing, and access controls such as masking and classification.
• Build security controls into GitHub repositories, GitHub Actions pipelines, and Terraform code through automated scanning, policy-as-code, and guardrails.
• Assess new cloud services and platform capabilities, including data, analytics, and AI services, and recommend controls before broad adoption.
• Collaborate with Platform Engineering, Cloud Operations, Data Engineering, Networking, and Security teams so solutions are secure, compliant, and fit with existing infrastructure, and write documentation that helps engineers apply security guidance.

• 7+ years in security engineering, security architecture, or cloud engineering with a security focus, including extensive hands-on AWS experience.
• Experience designing and reviewing secure architectures primarily on AWS, including threat modeling and security design reviews.
• Strong understanding of cloud security principles, identity and access management, network security, and secure defaults on cloud and data platforms.
• Strong hands-on experience securing AWS environments, including IAM, AWS Organizations and service control policies, VPC, KMS, EKS, CloudTrail, Security Hub, and GuardDuty.
• Hands-on experience securing Kubernetes workloads on Amazon EKS, including cluster hardening, RBAC and IAM roles for service accounts, network policies, and admission control.
• Hands-on experience with cloud security tooling such as Wiz, including posture management and attack path analysis, and routing findings to engineering teams.
• Proficiency with infrastructure as code (Terraform) and with at least one scripting or programming language (Python, TypeScript, Go, or similar) for security automation.
• Working knowledge of security frameworks such as NIST CSF, CIS Benchmarks, and ISO 27001.
• Commitment to ongoing learning as security threats and technology continue to evolve.

Preferred Experience:

• Experience securing and operating AI tooling and platforms in the cloud, such as Amazon Bedrock, AI coding assistants, and MCP integrations.
• Working knowledge of securing Azure and Google Cloud Platform, Key Vault on Azure and Cloud IAM and VPC Service Controls on Google Cloud Platform, and designing secure connectivity and identity between AWS and those platforms.
• Strong experience with DevOps practices and automated CI/CD pipelines, including GitHub Enterprise and GitHub Actions, and building security into those pipelines with static and dynamic analysis, dependency scanning, and secrets scanning.