Staff Cloud Security Engineer

Xometry operates a digital manufacturing marketplace connecting buyers with manufacturing capacity. The company is seeking a Staff Cloud Security Engineer to own cloud security posture, runtime detection, CrowdStrike administration, and cloud-native security monitoring. The role will secure AWS environments and Kubernetes workloads, develop detection and alerting capabilities, manage IaC security, and automate security workflows.

Responsibilities:

• Own CrowdStrike Falcon configuration, ensuring policies are appropriately scoped, tuned, and generating actionable alerts
• Partner with MDR to define alert routing, triage thresholds, and escalation logic, ensuring the right signals reach the right team
• Monitor cloud environments (primarily AWS) for security posture drift: misconfigured IAM roles, overly permissive security groups, exposed storage, and non-compliant resource configurations
• Secure Kubernetes clusters and containerized workloads: manage Network Policies, RBAC, Admission Controllers, and runtime detection for anomalous container behavior
• Develop and enforce cloud security policies and standards for AWS infrastructure, ensuring secure and scalable deployments align with organizational risk posture
• Evaluate and lead the implementation of additional detection tooling, including cloud SIEM platforms, designing detection rules and alerting pipelines
• Manage infrastructure as code (IaC) security using Terraform or OpenTofu — ensuring IaC definitions meet security standards before deployment
• Automate security posture checks and detection workflows using Python and shell scripting
• Stay current with the evolving cloud threat landscape and translate emerging threats into detection coverage or posture improvements

Requirements:

• • Minimum 8 years of experience in cloud security, security engineering, or a related infrastructure security discipline
• • Hands-on experience with a cloud security posture management (CSPM) platform — CrowdStrike, Wiz, Prisma Cloud, Orca, or equivalent
• • Deep familiarity with AWS security architecture: IAM/SCP policy design, VPC networking, security groups, CloudTrail, and cloud-native security controls
• GCP or Azure experience considered in lieu of AWS for strong candidates willing to expand into AWS
• • Proficiency with infrastructure as code (IaC) tools such as Terraform, OpenTofu, or CloudFormation, with an understanding of how to enforce security standards within IaC workflows
• • Strong Python and shell scripting skills for security automation, detection rule development, and tooling integration
• • Must be a US Citizen or legal permanent resident (Xometry handles ITAR-controlled data)
• Prior CrowdStrike experience is a plus but not required
• • AWS GovCloud experience
• • Hands-on Kubernetes security experience: securing and managing production clusters, including Network Policies, RBAC, and Admission Controllers
• • Experience with cloud-native SIEM solutions, including writing detection rules in Python or SQL
• • Experience securing microservices architectures, including service mesh security (Istio or Linkerd)
• • Bachelor's degree in Computer Science, Information Security, or a related field