> Markdown version of [/jobs/ext/4721363-software-engineer-staff-cloud-security-engineer](https://www.wearedevelopers.com/jobs/ext/4721363-software-engineer-staff-cloud-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Software Engineer - Staff Cloud Security Engineer - **Company:** Arena Intelligence, Inc. - **Location:** San Francisco, CA, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Training Data, Kubernetes Security, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Cloud Computing, Cloud Computing Security, Configuration Management, Continuous Integration, Data Infrastructure, Github, Design of User Interfaces, Human-Computer Interaction, Identity and Access Management, Python (Programming Language), PostgreSQL, OpenID, Operational Databases, Cloud Services, Software Engineering, TypeScript, Web Hosting Services, Google Cloud, Delivery Pipeline, Cloudflare, Build Tools, Virtual Agents, Terraform, Software Version Control, Databricks - **Published:** November 14, 2026 - **Apply:** https://www.careerbuilder.com/job-details/software-engineer-staff-cloud-security-engineer-ca--40b36350-5318-40d1-a74b-0e9b0b35a7f5 ## About the Role Software Engineering, Cloud Computing, Artificial Intelligence (AI), Training Data Sets, User Interface/Experience (UI/UX), Cloud Computing, Software Engineering, Source Code/Configuration Management (SCM), Web Hosting, Product Engineering, * 6+ years in security or infrastructure engineering, with at least 3 focused on cloud security in production. * Deep, current, hands-on experience securing AWS, GCP, and Cloudflare. You can describe what you built or configured in the last three months at keyboard level. * You have owned cloud security somewhere, not just worked a findings queue. You have made calls about how IAM and secrets should work, defended them, and lived with what they cost. You can name one you got wrong and changed. * Real depth in workload identity. OIDC, workload identity federation, IAM design, and secret managers. You can explain how a workload proves who it is without a stored key. * Rotation you have actually run. You can walk through rotating a production database or API credential without an outage, and what you would do differently next time. * Detection and response in the cloud. You have written detections, been paged by them, and investigated a real event from cloud audit logs. * Comfort in Terraform or a similar infrastructure-as-code tool, and in at least one language for automation such as Python, Go, or TypeScript. * Experience securing build pipelines and CI/CD, such as GitHub Actions and deployment credentials. * Hands-on with AI tooling in your own work. You use AI to build, script, and investigate, and you know where it belongs in a security workflow and where it doesn't. * Judgment about risk. You can tell a real exposure from a theoretical one, and say plainly which is which. * Comfort improving existing systems and documentation while keeping work moving. ## Description We are looking for a staff-level cloud security engineer to build and improve the controls that protect Arena's cloud infrastructure. You will set how workloads prove who they are, where machine credentials live and how they rotate, what our services can reach, and how we know when something is wrong. Then you will build the controls that enforce it, in code. This is a hands-on seat. You will do the work, not direct it from a distance. Our engineers build on cloud and managed platforms for hosting, data, workflows, source control, and builds. You will set the security requirements for workload identity, machine credentials, and cloud access across them. You'll work closely with platform, infrastructure, and product engineers to set cloud security requirements and build controls into the infrastructure they run. This role is onsite in our San Francisco office and reports to the Head of Security. YOU'LL * Design the cloud identity model for workloads, not just administer it. Least-privilege IAM, workload identity federation, and short-lived credentials. You decide what a workload can do and how it proves who it is. * Own machine secrets and rotation end to end. Every machine credential has an owner, a home in a central secret manager, and a rotation path that has been run, so rotating a key is routine and doesn't take the product down. * Set the rules for what each environment and service may reach, including limits on outbound connections, separation between environments, and the boundaries around agent runtimes. * Build security detections and alerts for high-risk changes to cloud infrastructure and build systems, and write response steps a colleague can follow without you. * Build cloud security checks into infrastructure code and build pipelines, so the secure path is the easiest one. * Secure the machine credentials and permissions used by source control, build pipelines, and cloud deployments. * Assess the technical access requested by vendors and managed platforms before onboarding. * Lead technical response to cloud infrastructure security events, working with the affected teams through recovery. * Keep cloud security posture visible to engineering and leadership, and improve it continuously. * Share the security on-call rotation., * Securing infrastructure for AI agent runtimes or sandboxed code execution * Kubernetes security, Postgres access controls, or data platform security such as Databricks * Leading incident response in a cloud environment * Compliance evidence work for cloud controls: SOC 2 or ISO 27001 * Experience as an early security hire at a fast-growing startup * Experience working with data protection requirements in logs and access controls