Engineering Manager II, Cloud Security

Qualia is hiring a player-coach Engineering Manager to build and lead its Cloud Security team. The role sets security direction for AWS, Kubernetes, and production access, hires and develops senior engineers, and leads cloud security architecture, guardrails, posture management, detection, and incident response.

Responsibilities:

• Lead and grow the team. Hire, coach, and set goals for Cloud Security engineers; own delivery against the roadmap
• Own cloud security architecture. Set standards for AWS account structure, network segmentation, encryption, and workload isolation across our Kubernetes clusters
• Run identity and access for production. Drive least privilege across human and machine identities: SSO into AWS, role design, just-in-time access, and secrets management
• Ship guardrails as code. Service control policies, admission control, policy-as-code checks in CI, and hardened Terraform modules that stop whole classes of misconfiguration
• Own posture management. Build our posture checks in-house, in Go and policy-as-code, across cloud resources and container images; turn findings into a prioritized, owned queue that burns down
• Build detection and response. Partner with SRE on cloud-native detection (CloudTrail, audit logs, runtime signal) and lead the cloud side of incident response
• Secure the delivery pipeline. Protect CI/CD, artifact provenance, and deploy credentials as production assets
• Partner across engineering. Review proposals; represent Cloud Security in SOC 2 and customer security reviews

Requirements:

• 7+ years in security, infrastructure, or platform engineering on production cloud systems, with 2+ years managing or leading engineers
• Deep hands-on AWS security: IAM and Organizations, VPC design, sops, logging, and the services that carry sensitive data
• Production Kubernetes security experience: RBAC, network policy, admission control, workload identity, and container image hygiene
• Infrastructure-as-code fluency (Terraform or similar) and a record of shipping guardrails engineers adopted
• You've built or scaled a cloud security function, or a major part of one, and can show what changed because of it
• Strong written communication: you can write the architecture standard, the incident post-mortem, and the one-page risk summary for leadership
• You measure impact by exposure removed and time-to-detect, and you can point to numbers
• Experience in fintech, real estate tech, or another regulated, high-liability domain
• Detection engineering or DFIR background in cloud environments
• Hands-on use of LLMs or agents in a security workflow such as posture triage, access review, or alert enrichment