Lead Cloud Security Engineer

The stack you'll work with:

Core — Hands-on day oneAWS IAM — roles, policies, trust and resource-policy patterns, permission boundaries, SCPs.Cloud Formation (JSON/YAML) — heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits).Python for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3).CI/CD pipelines (Git Hub Actions, Bamboo, or similar) for building, testing, and shipping controls.

Core AWS at org scale — Organizations, IAM Identity Center, and services such as Lambda, Event Bridge, Step Functions, S3, API Gateway, and Cloud Watch.

Nice to have — or you'll pick up fast Security-native AWS — Config, Secrets Manager, Cloud Trail, Access Analyzer, and KMS.CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana).Data skills (SQL and JSON, ETL, Tableau/Power BI).Multi-cloud exposure (GCP, Azure, OCI).Power Shell, PySpark, and AI-assisted tooling.

Core Responsibilities:

Technical Leadership Lead technical design reviews and own the standards for how controls are built, tested, and shipped — raising the bar on code quality, systems thinking, and operational readiness.

Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff.

Influence engineering patterns and best practices across teams — driving technical direction beyond your immediate team, without direct authority.

Solution Design & Delivery Design enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on — designing for auditability, fault tolerance, and graceful degradation when upstream systems change.

Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts — owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM).Move fluidly between design and hands-on build; stay close to the code.

Automation & Infrastructure as Code Build preventive and detective controls as code — author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (Cloud Formation and/or Terraform) and policy-as-code (Rego/OPA).Embed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control.

Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate).Security Engineering & Strategy Engineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale.

Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls.

Translate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness.

Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed.

Qualifications:

Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred.

Strong hands-on engineering — writes and ships production-grade code (Python or equivalent — production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with Cloud Formation day to day (Terraform a plus).Deep cloud expertise — hands-on experience across at…