Cloud Security Engineer

Confidential client is hiring a Cloud Security Engineer for its Enterprise Technology team. The role designs and implements cloud and data-platform security, identifies and remediates security gaps, and advises engineering and operations teams on secure architectures and practices.

Responsibilities:

• Find security issues across cloud and data platforms using posture assessments, reviews, and tools such as Wiz, then work with the owning teams to fix them and track each finding to closure
• Act as the SME for cloud security, setting the standards and reference patterns that engineering and data teams follow
• Define and implement security controls for AI tooling and platforms in the cloud, such as Amazon Bedrock, AI coding assistants, agent runtimes, and MCP integrations, covering model and data access, credentials and secrets, logging and monitoring, and guardrails
• Define and promote secure-by-default patterns for AWS, covering account structure, identity, networking, encryption, and logging, and extend them to Azure and GCP
• Harden containerized workloads on Amazon EKS and Kubernetes, setting guardrails for cluster configuration, workload identity, network policy, and container image and runtime security
• Work with engineering and operations teams on architecture and design reviews and threat modeling for new and changing systems, mainly on AWS with some Azure and GCP
• Design secure cross-platform integrations among AWS, Azure, GCP, Snowflake, and Databricks, including identity federation, private connectivity, data sharing, and access controls such as masking and classification
• Build security controls into GitHub repositories, GitHub Actions pipelines, and Terraform code through automated scanning, policy-as-code, and guardrails
• Assess new cloud services and platform capabilities, including data, analytics, and AI services, and recommend controls before broad adoption
• Collaborate with Platform Engineering, Cloud Operations, Data Engineering, Networking, and Security teams so solutions are secure, compliant, and fit with existing infrastructure, and write documentation that helps engineers apply security guidance

Requirements:

• 7+ years in security engineering, security architecture, or cloud engineering with a security focus, including extensive hands-on AWS experience
• Experience designing and reviewing secure architectures primarily on AWS, including threat modeling and security design reviews
• Strong understanding of cloud security principles, identity and access management, network security, and secure defaults on cloud and data platforms
• Strong hands-on experience securing AWS environments, including IAM, AWS Organizations and service control policies, VPC, KMS, EKS, CloudTrail, Security Hub, and GuardDuty
• Hands-on experience securing Kubernetes workloads on Amazon EKS, including cluster hardening, RBAC and IAM roles for service accounts, network policies, and admission control
• Hands-on experience with cloud security tooling such as Wiz, including posture management and attack path analysis, and routing findings to engineering teams
• Proficiency with infrastructure as code (Terraform) and with at least one scripting or programming language (Python, TypeScript, Go, or similar) for security automation
• Working knowledge of security frameworks such as NIST CSF, CIS Benchmarks, and ISO 27001
• Commitment to ongoing learning as security threats and technology continue to evolve
• Bachelor's degree or equivalent practical experience
• Strong problem-solving skills, with a track record of analyzing complex systems and identifying risk
• Strong interpersonal and communication skills, with the ability to explain complex topics and present to both technical and non-technical audiences
• Proven collaboration skills across multiple technology and project teams to deliver effective solutions
• Ability to communicate clearly in presentations and written documentation
• Ability to prioritize and deliver across competing demands
• Experience securing and operating AI tooling and platforms in the cloud, such as Amazon Bedrock, AI coding assistants, and MCP integrations
• Working knowledge of securing Azure and GCP, Key Vault on Azure and Cloud IAM and VPC Service Controls on GCP, and designing secure connectivity and identity between AWS and those platforms
• Strong experience with DevOps practices and automated CI/CD pipelines, including GitHub Enterprise and GitHub Actions, and building security into those pipelines with static and dynamic analysis, dependency scanning, and secrets scanning
• Concentration in Computer Science, Software Engineering, Information Technology, Cybersecurity, or similar discipline, strongly preferred
• Security certifications such as CISSP, CCSP, or GIAC preferred
• AWS Certified Security – Specialty or AWS Certified Solutions Architect strongly preferred; Microsoft Azure Security Engineer, Google Cloud security, Snowflake, or Databricks certifications a plus