Lead Cloud Security Engineer

Join us to make a meaningful impact on the security of our global cloud infrastructure. As a Lead Cloud Security Engineer, you will help shape the future of cybersecurity and technology controls at JPMorgan Chase & Co. You'll collaborate with talented professionals, drive innovation, and advance your career in a dynamic environment. We value your expertise and commitment to continuous improvement.

Experience the opportunity to lead, mentor, and influence the direction of cloud security.

As a Lead Cloud Security Engineer in the Cybersecurity & Technology Controls Product Security team aligned to the Azure Cloud programme, you will ensure public cloud adoption is secure and compliant. You will identify and manage risk-related issues, partner with senior leaders, and drive automation of controls. Your role is pivotal in keeping the firm protected, stable, and resilient. You will contribute to a culture of ownership and continuous improvement.

• Contribute to the evolution of a multi-year information risk and control strategy for public cloud, setting vision, OKRs, and KRIs that align with enterprise risk appetite, policies, and regulatory expectations.
• Use enterprise-authorized AI capabilities within the work environment to accelerate threat modeling, vulnerability analysis synthesis, and security documentation, validating outputs and ensuring sensitive data is handled appropriately.
• Lead risk-based design and assessment of security controls across cloud services, platforms, and reference architectures; establish standardized control baselines and reusable patterns for AWS, Azure, and GCP.
• Chair or co-chair governance forums, make informed risk acceptance decisions, and drive timely remediation, deviation tracking, and benefits realization.
• Partner with senior leaders across engineering, product, and risk to embed security by design, ensuring deep integration with security operations, threat intelligence, IAM, network security, and data protection.
• Set the operating model for infrastructure as code security: define guardrails, policy as code, and automated pre-commit/pre-deploy controls; oversee security reviews for Terraform and platform engineering pipelines.
• Establish and maintain authoritative documentation, standards, and playbooks; implement agile delivery mechanisms for security programs at scale.
• Build, mentor, and lead a high-performing matrixed team of security engineers and risk analysts; develop talent, clarify accountabilities, and cultivate a culture of ownership and continuous improvement.
• Define and report control effectiveness and residual risk through executive-ready dashboards; brief senior stakeholders, audit, and regulators; ensure audit readiness and sustainable evidence practices.
• Drive the tooling and automation strategy for cloud security, including build vs buy evaluations, vendor management, and integration with existing telemetry and SOAR platforms.
• Strengthen cloud incident preparedness and response by leading threat modeling, tabletop exercises, and post-incident reviews that translate lessons learned into control enhancements.
• Apply reuse-first, AI-assisted practices within SDLC/toolchain routines to strengthen security testing and control validation, ensuring traceability/auditability and alignment to resiliency and security expectations.

• Formal training or certification on security engineering concepts and advanced applied experience.
• Skilled in planning, designing, and implementing enterprise-level security solutions.
• Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support security engineering workflows with strong validation habits and awareness of data sensitivity.
• Ability to review and validate AI-assisted code/security recommendations before adoption, escalating uncertainty and ensuring outcomes align to security, resiliency, and auditability expectations.
• Advanced in one or more programming languages.
• Proficient across SDLC execution, including agile methodologies such as CI/CD, application resiliency, and security.
• Experience with threat modeling, discovery, vulnerability, and penetration testing.

• Deep expertise securing public cloud at scale, spanning identity and access management, network segmentation, data protection, logging/monitoring, and native cloud services across AWS, Azure, and/or GCP.
• Proven leadership of…