Senior Cloud Security Engineer (AWS)

Abnormal AI is seeking a Senior Cloud Security Engineer to build and scale security capabilities across its primarily AWS-based cloud environment. The role leads security architecture, threat modeling, preventative and detective controls, AI-assisted security automation, incident response, and technical mentorship across engineering teams.

Responsibilities:

• Lead threat modeling and security design discussions with both platform and product teams, translating risks into engineering actions and using AI to rapidly stress-test designs against attack scenarios before committing engineering time to a direction
• Partner with product engineering to review the security architecture of new product features — assessing designs for data exposure, access control, and abuse-case risk before they ship — using AI to speed up first-pass analysis so your review time goes toward the highest-risk decisions
• Collaborate with Platform, Infra, and DevOps teams to build scalable preventative controls in AWS via Infrastructure-as-Code — using AI coding agents to scaffold and iterate on Terraform/CloudFormation modules, reserving your own time for least-privilege review, blast-radius analysis, and edge cases
• Evaluate and uplift security tooling across commercial, cloud-native, and AI-assisted capabilities, focusing on scale, efficiency, and precision
• Mentor engineers on how to get real leverage from AI — reviewing AI-generated code and infrastructure together, and turning recurring feedback into standards and reusable playbooks instead of repeating it review after review
• Use AI to rapidly prototype automation for signal correlation, alert enrichment, and auto-remediation of known failure patterns, then harden and productionize what proves out rather than hand-building every workflow from a blank file
• Architect, build, and validate integrations between AWS and other cloud-native infrastructure and security tooling (e.g., SIEM, SOAR, IAM tooling), with a growing share of first-draft code AI-generated and human-owned
• Serve as a hands-on technical contributor during security incidents, using AI to accelerate log and telemetry triage while owning the judgment calls that determine root cause and response
• Build and maintain reusable AI-assisted playbooks (for IaC security review, detection authoring, alert triage) that scale your judgment across the security and platform teams

Requirements:

• • An intellectually curious, solution-focused engineer with a security mindset who thrives in fast-paced environments
• • A technical leader who can architect scalable security solutions while maintaining engineering velocity — increasingly by directing AI to do the first draft and applying judgment to the result
• • Someone who thinks like an attacker but builds like a defender, and who treats AI-generated infrastructure and detection logic with the same scrutiny as a junior engineer's first PR
• • Someone with high agency who proactively spots what in their own workflow (and the team's) AI can absorb, and actually builds the automation to make that real — not someone waiting to be told
• • A collaborative engineer who can translate security requirements into actionable engineering tasks
• • A mentor who scales their judgment across the team — reviewing AI-generated code and infra for security gaps, and encoding what they learn into reusable playbooks and standards rather than repeating the same feedback one engineer at a time
• • Proven delivery in security engineering or infrastructure security roles, ideally in cloud-native environments
• • Deep comprehension of native AWS architecture services and identity/access patterns — IAM, STS, cross-account roles and resource policies, VPC and network segmentation, KMS — with AWS as our primary cloud platform, plus working knowledge of Azure and GCP
• • Strong scripting and dev fundamentals in Python and/or Go — enough to read, critique, and confidently modify AI-generated code, not just prompt for it; proficiency with Git, Linux, and infrastructure automation patterns
• • Demonstrated fluency directing AI coding/agent tools (e.g., Claude Code, Cursor, Copilot) to accelerate delivery, paired with the judgment to catch when AI-generated infrastructure or security logic is wrong, incomplete, or dangerous
• • Expertise in integrating or building tooling for SIEM, SOAR, vulnerability management, and CSPM platforms
• • Experience deploying security controls via Infrastructure-as-Code (Terraform or CloudFormation), primarily in AWS
• • Comfortable investigating logs, tracing events, and contributing to incident analysis workflows
• • Proven ability to influence and collaborate cross-functionally with engineering, infra, product, and IT
• • Strong written communication and documentation skills, with the ability to convey complex designs clearly
• • Background with using and securing container orchestration (Kubernetes), including workload security and service mesh controls
• • Experience working in fast-paced or startup environments with sometimes ambiguous ownership lines
• • Experience building or operating agentic workflows/AI tooling for security use cases (detection authoring, alert triage, IaC generation/review)
• • Familiarity with JavaScript or TypeScript, particularly in the context of DevOps tooling or plugins
• • Hands-on experience with commercial Cloud Security tools (CNAPP, CSPM, DSPM, KSPM)
• • Prior experience building security telemetry pipelines or log correlation frameworks
• • Exposure to compliance frameworks (SOC 2, ISO 27001) and how engineering decisions affect auditability
• • Familiarity with CI/CD systems and integrating security checks into developer workflows