Senior Engineer, Cloud Security

Are you ready for new challenges and new opportunities?

Join our team!

Current job opportunities are posted here as they become available.

Millions of shipments with goods and materials move around the world daily, by land, sea, or air. Pay Cargo is the world's leading online payment solution that is revolutionizing the shipping and cargo world. With a fast and efficient way to reduce costs associated with payment processing, we help improve the speed and profitability of our customers' businesses.

Pay Cargo's platform connects payers and vendors across the cargo and logistics ecosystem, supporting payments, remittance data, integrations, vendor release workflows, and customer-facing digital experiences.

The Senior Engineer, Cloud Security is responsible for strengthening and operating Pay Cargo's security controls across a modernizing platform that spans legacy systems, a multi-account AWS environment, Microsoft Entra , Git Hub/Zen Hub workflows, Git Hub Actions pipelines, and a growing set of secure AI platform requirements. This is a senior, hands‑on engineering role — not an entry‑level or SOC‑analyst position — focused on implementing and operating security controls, not only monitoring them.

This is a hands‑on individual contributor role on Pay Cargo's Dev Sec Ops  team. The Senior Engineer
- Cloud Security continuously monitors the perimeter, hardens cloud and endpoint controls, runs access reviews, supports audits, and leads incident response, turning security obligations into repeatable operational controls rather than one‑time checklist items. The role requires strong judgment, strong follow‑through, and the ability to reduce reactive fire drills while raising overall control maturity.

The Senior Engineer, Cloud Security partners closely with Dev Ops, Engineering, Architecture, Product, Compliance, Support, and executive stakeholders to keep Pay Cargo's global payments platform secure, available, and audit‑ready.

This position has no direct reports. The role leads indirectly by setting and enforcing security standards, guiding engineers and Dev Ops toward secure patterns, and reducing single points of failure across the security function.

• Monitor the perimeter, cloud, and endpoint environments for threats, misconfigurations, and anomalous activity across AWS and Microsoft Entra
• Operate and tune security tooling, including Crowd Strike, Microsoft Defender, and Cloud Watch and SNS logging and alerting
• Triage security alerts, drive incident response, and lead root cause analysis with clear, durable follow‑up
• Maintain and improve on‑call and escalation workflows (e.g., Pager Duty) so security events are handled consistently

• Run periodic access reviews and enforce least privilege across AWS IAM and IAM Identity Center, Microsoft Entra , and SaaS platforms
• Strengthen RBAC/ABAC, MFA, and SSO, SAML2, and OAuth2/OIDC patterns across internal and customer‑facing systems
• Reduce standing access and broad repository or local admin privileges in favor of bounded, auditable access
• Operate the federated access model, including SAML‑based assumed access to AWS (via Common Fate Granted) and Git Hub OIDC for pipelines, so people and CI receive least‑privilege, time‑bound access without static credentials
• Operate the PKI, including AWS Private CA and ACM, certificate issuance and rotation, CRLs, and mTLS trust stores on load balancers
• Administer Entra s and the Tailscale ACLs that gate network access
• Govern dependency and supply‑chain risk using Dependabot and approved‑package practices, and keep secrets in AWS Secrets Manager and SSM Parameter Store

• Support SOC 1 Type 2, SOC 2, and PCI DSS obligations by owning the implementation of controls and the evidence behind them
• Coordinate penetration testing, remediation tracking, and verification of fixes
• Produce clean, repeatable audit evidence and reduce last‑minute audit scrambles
• Translate compliance requirements into operational controls engineers can follow without constant guidance

• Help…