Senior Cloud Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the security posture for cloud environments across AWS, GCP, and Azure.

• Create secure reference architectures and reusable patterns for account/project organization, network segmentation, encryption, key management, and secrets management.

• Integrate security into Infrastructure as Code (IaC) through fortified modules, policy as code, and pre-deployment evaluations.

• Safeguard CI/CD pipelines and the software supply chain.

• Design and enforce least-privilege Identity and Access Management (IAM), federation, and regular access reviews.

• Develop code and scripts to automate security controls, remediation processes, and evidence gathering.

• Operate and fine-tune Cloud Security Posture Management (CSPM) and cloud-native security services, ensuring findings lead to remediation.

• Build logging and detection mechanisms for cloud control-plane and workload activities.

• Lead incident response efforts on the cloud side.

• Contribute security controls and documentation to SOC 2, ISO 27001, and similar compliance initiatives.

• Map the cloud environment and identify key risks with a remediation strategy within the first 90 days.

• Establish baseline guardrails, centralized logging, and posture monitoring across cloud accounts and projects.

• Automate security checks for infrastructure changes within CI/CD and facilitate early security engagement by engineers.

• Collaborate with platform and infrastructure engineering, customer support, delivery teams, IT, and compliance.

⛳️ Requirements

• Experience in DevOps, Site Reliability Engineering (SRE), or platform engineering.

• Proven experience with production infrastructure and CI/CD pipeline operations.

• Hands-on experience securing at least two major cloud providers: AWS, GCP, or Azure.

• Understanding of the differences in cloud identity, networking, and logging models.

• Extensive knowledge of cloud security best practices, including CIS Benchmarks and provider-specific security guidelines.

• Familiarity with least-privilege IAM, workload identity, network segmentation, private connectivity, encryption and key management, secrets management, centralized logging, and preventive guardrails.

• Strong coding and scripting capabilities in at least one general-purpose programming language, such as Python or Go, as well as shell scripting.

• Practical experience with IaC tools, such as Terraform or OpenTofu, including the integration of security checks.

• Excellent communication skills.

• Knowledge of open-source cloud security tools, such as Prowler, Checkov, Trivy, OPA, or Falco.

• Experience with container and Kubernetes security, including admission control and runtime policy.

• Relevant cloud security certification is a plus.

• Experience securing SaaS and developer platforms, including identity providers and GitHub organizations.

• Familiarity with supporting SOC 2, ISO 27001, or similar compliance programs.

• Hands-on experience in cloud incident response or forensics.

• Must be authorized to work in the U.S. for Tessera Labs.

🏝️ Benefits

• [Insert benefits here]

• [Insert additional benefits here]