Security Engineer, Cloud & AI Platform

Location US TN
- Remote Business
- Real Estate

Brookfield has a unique and dynamic culture. We seek team members who have a long-term focus and whose values align with our Attributes of a Brookfield Leader:
Entrepreneurial, Collaborative and Disciplined. Brookfield is committed to the development of our people through challenging work assignments and exposure to diverse businesses.

The Staff Security Engineer, Cloud & AI Platform is a deeply technical, hands‑on role responsible for making Brookfield Real Estate’s cloud and AI platforms secure by design. You will lead security architecture and implementation across AWS, Infrastructure as Code, software delivery, internally developed applications, and AI/agent systems. This is a builder role. You will threat‑model a design, review the underlying Terraform and application code, implement the control, instrument it, and help teams adopt it without unnecessary friction.

Security requirements become reusable modules, automated checks, secure defaults, and clear engineering guidance rather than documents and findings lists. You will partner closely with Cloud Solutions, application engineering, AI engineering, Identity, Cyber Ops, and GRC/Privacy. Platform engineering continues to own general platform uptime, capacity, and deployment mechanics, and Cyber Ops continues to own alert triage; this role owns the architecture, controls, tooling, and assurance mechanisms that make those systems safe.

• Leadership & Security Architecture:
  Help define security architecture for the cloud and AI platforms: set direction, write specs, and steward secure‑by‑default patterns across teams.
• Define security engineering standards and paved roads, document important decisions, and communicate risk and trade‑offs to engineering and business leadership.
• Review infrastructure and application designs for authorization, network, data‑protection, secrets, and tenant‑isolation risks.
• Mentor engineers and raise the organization’s ability to make sound security decisions independently.
• Partner with Cloud Solutions, application engineering, AI engineering, Identity, Cyber Ops, and GRC/Privacy to prioritize work and drive adoption.
• Cloud & Identity Security:
  Own and evolve security architecture for a multi‑account AWS organization — account boundaries, service control policies, IAM Identity Center, delegated security services, KMS, VPC controls, and WAF.
• Design least‑privilege human and workload access across AWS, Okta, Git Hub Actions, and Infrastructure as Code platforms using federation and short‑lived credentials.
• Build and maintain reusable security controls in Terraform or Open Tofu, with safe rollout, testing, monitoring, and recovery patterns.
• Strengthen centralized logging and evidence — Cloud Trail, Config, Guard Duty, Security Hub, Macie, and Cloud Watch — and keep guardrails current as the environment grows.
• Secure Software Delivery:
  Establish secure Git Hub Actions and runner patterns, including OIDC trust, environment separation, workflow protection, action pinning, artifact integrity, and least‑privilege deployment roles.
• Integrate practical security checks into developer workflows — secrets detection, dependency and container scanning, SBOMs, Infrastructure as Code analysis, code scanning, and risk‑based release gates.
• Support vulnerability management for internally developed software, from detection and prioritization through remediation evidence and exception handling. Partner with the Vulnerability Manager to establish prioritization and reduce false positives.
• Improve controls with engineers rather than around them, avoiding noisy or easily bypassed gates.
• Application & AI Security:
  Lead threat modelling and security design reviews for web applications, APIs, data ingestion, authentication and authorization flows, and agentic systems.
• Define secure patterns for Amazon Bedrock and other model platforms, including model access, guardrail lifecycle, invocation logging, usage attribution, and sensitive‑data controls.
• Harden agent tools, MCP servers, gateways, sandboxes, and code‑execution environments against prompt…