Senior Engineer, Cloud Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Design and uphold reusable Terraform and CloudFormation modules for IAM, networking, and logging.

• Deploy and oversee AWS multi-account architectures, incorporating Organizations and SCPs.

• Construct Azure Hub-Spoke and Landing Zone frameworks.

• Apply least-privilege IAM principles utilizing RBAC, ABAC, permission boundaries, JIT or PIM automation, and federated identity through Okta or Entra ID.

• Address cloud misconfigurations through engineering solutions, automated patching, and configuration drift remediation.

• Create automated remediation workflows employing Lambda, Azure Functions, and Python.

• Integrate SAST, DAST, and secret scanning into GitHub Actions or Azure DevOps pipelines.

• Deploy and optimize AWS GuardDuty, Security Hub, AWS Config, Microsoft Sentinel, and Defender for Cloud.

• Develop native logging pipelines for SIEM ingestion.

• Design VPCs, security groups, network segmentation, WAFs, and full-lifecycle encryption utilizing AWS KMS and Azure Key Vault.

• Convert NIST 800-53, FedRAMP, and CMMC criteria into technical controls across cloud environments.

• Collaborate directly with client engineering teams and facilitate architectural workshops.

• Manage multiple client engagements concurrently.

• Assume direct responsibility for cloud security engineering tasks, vulnerability remediation, and client engagements within the first 15 days.

• Work with client engineering leads during U.S. Eastern Time business hours to execute automated security operations.

⛳️ Requirements

• Extensive technical knowledge in cloud infrastructure engineering, particularly focusing on Azure and multi-cloud architectures.

• Demonstrated experience in deploying security infrastructure, crafting OPA policies, and managing secrets in Vault or AWS Secrets Manager.

• In-depth proficiency in Azure and AWS.

• Strong skills in Terraform, including module versioning, state management, and provider security controls.

• Comprehensive understanding of SAML, OIDC, cross-account IAM roles, and least-privilege enforcement.

• Capability to lead technical workshops and articulate complex architectures to engineering teams.

• Ability to juggle multiple client priorities and execute rapid remediation in a dynamic startup environment.

• Technical cloud security certification such as AWS Certified Security Specialty, Azure Security Engineer Associate, or GCP Professional Security Engineer.

• Practical experience in configuring and enforcing FIPS 140 standards across cloud services.

• Hands-on experience in building CMMC-compliant enclaves or FedRAMP security architectures.

• Experience with implementing container runtime security controls and vulnerability scanning.

• Excellent written and verbal communication skills in English.

• Reliable, high-speed internet connection and a professional home office setup.

• Availability for a regular schedule of 8:00 AM–5:00 PM US Eastern Time, with occasional flexibility.

• Willingness and ability to travel locally for infrequent onsite meetings, team gatherings, or business activities.

• Participation in live video interviews with the camera on and identity verification during the recruitment and onboarding process.

• Successful identity verification and background screening, where allowed by law.

• Authorization to work in the U.S. without current or future visa sponsorship.

🏝️ Benefits

• Career development opportunities through mentorship and training.

• Reimbursement for approved training and certification courses pertinent to the current role.

• Competitive base salary with regular performance evaluations tied to merit-based assessments and bonus potential.

• Significant opportunities for career progression.

• Remote-first culture offering flexibility to work from anywhere while collaborating with a global team.