Cloud Security Engineer

About

The Role

At Opendoor our goal is to build the biggest, most trusted housing platform and set a new standard for how people move. We’ve combined our deep, proprietary data and operational expertise with the power of artificial intelligence to make online home selling and buying radically simple. Our Security Engineering team is building intelligent systems that protect Opendoor and our customers while enabling unprecedented engineering velocity.

We apply software engineering and AI to solve security problems across product, infrastructure, and operations by building guardrails where they matter, not gates where they don’t. As our Cloud Security Engineer, you’ll own the security of the infrastructure that runs Opendoor — multi-account AWS, EKS, the IAM and identity plane connecting Okta to every system, and the cloud workloads that handle home acquisition, resale, mortgage, title, and escrow.

You’ll inherit a recently-completed EKS migration, an in-progress CSPM/CNAPP replacement, and a zero‑trust roadmap waiting for a technical owner.

• Own the security architecture of our AWS estate across multiple accounts, EKS clusters, Terraform‑managed infrastructure, and the IAM plane that ties everything together.
• Manage and optimize our CNAPP and CSPM cloud security tooling, ensuring platforms are effectively integrated into engineering workflows to drive the automated remediation of infrastructure risks.
• Modernize our secure access strategy by deploying Zero Trust principles—integrating device trust and identity‑aware proxies—to provide seamless, least‑privileged access to internal infrastructure.
• Harden our EKS environment—RBAC, admission policies, workload identity, runtime protection, image signing, and base‑image strategy on top of our Bottlerocket + Karpenter foundation.
• Build new agentic detection‑and‑response workflows using Lambda + AWS‑native primitives that close the loop from alert to investigation to remediation.
• Drive a 'Shift‑Left' cloud security strategy within our pipelines using Terraform/Terrakube, Git Hub Actions, ECR—so that misconfigurations get caught at PR time, not in a CSPM dashboard a week later.
• Partner with the Infrastructure team on cloud‑native security decisions: VPC architecture, ingress, secrets management (Vault), service identity, and how Okta extends into AWS, Azure, and GCP.
• Run our cloud detection engineering:
  Guard Duty, Security Hub, Cloud Trail, VPC flow logs—tuned for signal, integrated with Datadog and our incident response playbooks.
• Support cloud security for our subsidiaries (OS National, Mainstay Title) including Azure Windows AD environments, with adversarial review of the systems that touch fraud risk.
• Set the bar for what "secure by default" looks like for AI‑maximalist engineering—vibe‑coded apps, MCP servers, and agent‑driven workflows that touch production cloud infrastructure.
• Mentor engineers across Security, Infra, and Product Eng on cloud security patterns, and turn the patterns you see into automated guardrails so the next team doesn’t make the same mistake.

• Cloud: AWS, Azure, GCP
• Containers / Orchestration: EKS, Bottlerocket, Karpenter, Helm, Argo CD
• IaC:
  Terraform, Terrakube (self‑hosted)
• Identity & Access:
  Okta, Duo, AWS Identity Center, Okta‑OIDC for EKS, Platform SSO (macOS), Hashicorp Vault
• Cloud Security:
  Guard Duty, Security Hub, Cloud Trail, Git Hub Advanced Security; CSPM/CNAPP replacement in flight (Wiz, Datadog Cloud Security, Crowd Strike Falcon Cloud Security under eval)
• Detection / Observability:
  Datadog (security + observability), Cribl, Cloud Trail, S3 archive
• Languages:
  
  Go, Python, Type Script, Ruby, HCL
• AI Tooling:
  Claude, OpenAI, Claude Code, Runlayer MCP, custom agent frameworks used heavily for alert triage, IaC review, and remediation drafting

• Deep conviction that AI and automation should eliminate manual work humans shouldn’t be doing anyway. You’re excited to replace ticket toil and manual cloud config review with automated systems, IaC guardrails, and agents.
• Business enablement security mindset—you measure success by business impact and informed risk‑taking, not by tickets opened or compliance…