Staff Cloud Security Engineer

Accountabilities

• • Design and integrate security controls directly into CI/CD pipelines using platforms such as GitHub, GitLab, Jenkins, or Azure DevOps.
  • Evaluate, configure, and manage Infrastructure as Code security scanning tools to identify meaningful risks and reduce false positives.
  • Build automated developer feedback and remediation workflows that encourage secure-by-default development practices.
  • Develop automation scripts using Python, Bash, or PowerShell to streamline security processes and improve operational efficiency.
  • Establish and maintain IAM controls across cloud environments, enforcing least-privilege access and secure identity practices.
  • Define standards and lifecycle controls for non-human identities, APIs, application credentials, and cloud secrets.
  • Develop secure infrastructure baselines, vulnerability management processes, and hardening standards across AWS, Azure, and/or GCP.
  • Use Terraform, CloudFormation, Bicep, or comparable IaC technologies to ensure infrastructure is secure, repeatable, and auditable.
  • Lead or contribute to high-impact infrastructure security initiatives, including multi-cloud network isolation, secure multi-tenant architectures, and continuous remediation of misconfigurations.
  • Advise engineering teams on secure cloud-native architectures spanning microservices, serverless applications, containers, and PaaS workloads.
  • Strengthen container and Kubernetes security through runtime controls, supply-chain protections, and configuration assessments.
  • Develop security approaches for AI/ML systems, addressing adversarial threats, unauthorized access, model protection, and data pipeline security.
  • Protect sensitive cloud and AI data through encryption, anonymization, secure storage, tokenization, and appropriate data protection controls.
  • Partner with Security Operations to improve cloud telemetry, logging, observability, and detection capabilities.
  • Onboard relevant cloud log sources and develop detection rules for cloud-based threats using SIEM, CSPM, CWPP, and related technologies.
  • Support the triage, investigation, and forensic analysis of cloud and application security incidents, collaborating on containment and remediation.
  • Translate complex security requirements into practical guidance for both technical and non-technical stakeholders.

  Requirements

  • 7–10+ years of hands-on experience in cloud security, application security, DevSecOps, or closely related engineering disciplines.
  • Deep practical expertise securing AWS and/or Azure environments, including the design and maintenance of controls for multi-cloud applications.
  • Strong knowledge of cloud identity and access management, infrastructure security, vulnerability management, network security, data protection, and security monitoring.
  • Proficiency with Python, Bash, PowerShell, or similar scripting languages for security automation.
  • Strong understanding of Docker, Kubernetes, container security, and cloud-native application architectures.
  • Hands-on experience securing Infrastructure as Code, particularly with Terraform, ARM, CloudFormation, Bicep, or comparable technologies.
  • Experience integrating security practices into CI/CD pipelines and applying DevSecOps principles across software development workflows.
  • Familiarity with SIEM, CSPM, CWPP, cloud logging, telemetry, detection engineering, and incident response practices.
  • Knowledge of AI/ML security considerations, including protection of models, data pipelines, identities, and workloads, is highly valuable.
  • Relevant industry certifications such as CCSP, CISSP, AWS Security Specialty, Azure Security Engineer, GCSA, or OSCP are strongly preferred.
  • A proactive builder mindset, with a demonstrated ability to identify security gaps, improve processes, and develop scalable solutions.
  • Strong cross-functional collaboration and communication skills, with the ability to explain sophisticated security concepts clearly to varied audiences.
  • Comfortable operating in a rapidly changing environment and continuously adapting to emerging cloud, application, and AI security threats.

  Benefits

  • Competitive base salary of $168,200–$252,200 for eligible US locations, with a higher range of $179,900–$269,900 applicable to CA, CT, DC, MD, MA, NJ, NY, VA, and WA.
  • Annual bonus and equity opportunities as part of the total compensation package.
  • Company-sponsored medical, dental, and vision coverage, including fully employer-paid options and substantial dependent coverage.
  • FSA and HSA options.
  • 401(k) match.
  • Telehealth benefits, including One Medical membership options.
  • Flexible paid time off and support for autonomous work.
  • Learning and development opportunities, comprehensive onboarding, leadership training, and professional growth programs.
  • Recognition programs, including peer-nominated awards and rewards.
  • Parental leave and family support programs.
  • Up to $20,000 in fertility services, including IUI and IVF, plus surrogacy and adoption reimbursement.
  • Maternity support through Maven Maternity and free breast milk shipping through Maven Milk.
  • Pet insurance, legal advisory services, financial planning tools, and additional wellness and family benefits.
  • Fully remote work environment with flexibility and opportunities to work on cutting-edge cloud and AI security challenges.