Manager, Cloud Security Engineering

Workstreet is seeking a Manager, Cloud Security Engineering to lead engineers delivering cloud security controls for clients across AWS, Azure, and GCP. The role owns team development, client engagement delivery, engineering standards, cloud architecture and incident response, while ensuring technical controls meet security and compliance requirements.

Responsibilities:

• Lead and develop the team: manage, coach, and grow Cloud Security Engineers through clear expectations, regular feedback, performance reviews, and defined career paths
• Hire and onboard: build the interview process, recruit and select engineers, and onboard them so they take direct ownership of client work quickly
• Own delivery across the client portfolio: plan capacity, assign engineers to engagements, track milestones and quality, and make sure multiple concurrent engagements stay on schedule without sacrificing technical rigor
• Serve as the escalation point: handle technical and relationship escalations calmly, and lead conversations with client engineering leads and executives on scope, risk, and remediation priorities
• Set engineering standards: define and maintain reusable Terraform and CloudFormation baselines, landing zone patterns, IAM and logging modules, and code review practices that make client environments drift-resistant
• Guide cloud architecture decisions: review designs for AWS multi-account structures, Azure Hub-Spoke and Landing Zone architectures, least-privilege IAM, network segmentation, and encryption using services such as AWS KMS and Azure Key Vault
• Direct native security tooling: set the approach for deploying and tuning AWS GuardDuty, Security Hub, AWS Config, Microsoft Sentinel, and Defender for Cloud, including logging pipelines for SIEM ingestion
• Embed security in delivery pipelines: establish guardrails and automated remediation workflows, including SAST, DAST, and secret scanning in GitHub Actions or Azure DevOps
• Translate frameworks into functional controls: ensure technical controls satisfy SOC 2, ISO 27001, HIPAA, GDPR, CMMC, NIST 800-171, NIST 800-53, and FedRAMP requirements in practice, not only on a compliance map, and that evidence supports audit readiness
• Oversee incident response: set the escalation path for cloud security incidents and ensure rapid containment, diagnostics, and post-incident improvements
• Collaborate across Security Services and GRC: coordinate with GRC delivery teams, and provide technical input on scoping, statements of work, and new client opportunities
• Continuously improve the practice: track delivery health, remediation cycle times, and module reuse, and invest in tooling and automation that removes repetitive work for the team
• Stay hands-on where it counts: step into architecture reviews, complex remediations, and client workshops to unblock engineers and maintain technical credibility

Requirements:

• experienced people manager who has hired, coached, and retained engineers, and who sets a high bar for work quality while backing the team under pressure
• deep, hands-on background securing AWS, Azure, and GCP environments, including IAM strategy (RBAC, ABAC, permission boundaries, federated identity via Okta or Entra ID), network zoning, encryption, and logging
• fluent in Terraform, with working knowledge of CloudFormation, Python, or Bash, and able to review module design, versioning, state management, and provider security controls
• maps technical cloud configurations to SOC 2, ISO 27001, GDPR, and HIPAA requirements, and distinguishes compliance mappings from functional technical controls
• thrives in a fast-paced startup environment, balancing multiple client portfolios and competing priorities while keeping the team focused on rapid, well-governed remediation
• partners with US-based technology founders, DevOps leads, and executive teams, handles escalations with calm professionalism, and leads architectural workshops
• delivers precise written and verbal English communication that translates complex cloud risks into clear business decisions for both engineers and executives
• Applicants must be authorized to work in the U.S. without the need for visa sponsorship now or in the future. Workstreet does not provide employment-based visa sponsorship or transfers for this role, including H-1B, L-1, TN, O-1, E-3, H-1B1, F-1 (OPT/CPT), J-1, or any other work-authorized visa category
• active certifications such as AWS Certified Security – Specialty, Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, CISSP, CISM, or CISA
• in a consulting, MSSP, or hyper-growth technology environment, including capacity planning and resourcing across client engagements
• hands-on history building CMMC-compliant enclaves or FedRAMP security architectures, including NIST 800-53 and NIST 800-171 control implementation
• practical experience configuring and enforcing FIPS 140 standards across cloud services
• experience securing microservice architectures, Docker, and Kubernetes, including runtime security controls and vulnerability scanning
• direct experience with identity-centric security policies, network micro-segmentation, and context-aware access
• advanced use of logging platforms, SIEM, vulnerability management engines, and threat hunting feeds