Cloud Security Engineer

Who we are

Aurora’s mission is to deliver the benefits of self-driving technology safely, quickly, and broadly.

The Aurora Driver will create a new era in mobility and logistics, one that will bring a safer, more efficient, and more accessible future to everyone.

At Aurora, you will tackle massively complex problems alongside other passionate, intelligent individuals, growing as an expert while expanding your knowledge. For the latest news from Aurora, visit aurora.tech or follow us on Linked In.

Aurora’s Cloud Security team’s mission is to design and build security capabilities for Aurora infrastructure and services. Aurora makes extensive use of public cloud infrastructure (AWS), Kubernetes and infrastructure-as-code technologies.

This role requires a deep, hands‑on understanding of cloud security principles and architecture, particularly within AWS and Kubernetes (EKS). As a Staff Engineer, you will help drive the vision, design, and implementation of security infrastructure, serving as a technical leader and mentor within the security team and across engineering. You can read more about our approach to security on our blog:
Aurora's approach to cybersecurity for autonomous trucking.

• Elevate Security Architecture:
  Design, implement, and maintain the next generation of security infrastructure, controls, and primitives natively within AWS and across our Kubernetes (EKS) platform.
• Define Security as Code:
  Drive the adoption of Infrastructure as Code (IaC) principles (e.g., Terraform) to codify, deploy, and continuously monitor security controls and policies in an auditable and scalable manner.
• Strategic Threat Modeling:
  Lead advanced threat modeling exercises for critical systems and architectures, translating risks into prioritized security requirements and verifiable controls.
• Architectural Guidance:
  Act as a security consultant for product and platform engineering teams, conducting in‑depth security design reviews and providing pragmatic, hands‑on recommendations for securing complex microservice architectures.
• Automate Remediation:
  Identify systemic security weaknesses and create robust, scalable automation (e.g., Python/Go‑based tools, Lambda functions, EKS controllers) to eliminate classes of vulnerabilities at the source.

• Lead the design and implementation of core security infrastructure services, including certificate management (PKI), secrets management, and centralized authentication/authorization services leveraging standards like OIDC and SAML.
• Deep AWS Security Specialization:
  Architect and manage security boundaries and access controls for the entire AWS environment, including but not limited to:
  • IAM Governance:
    Define and enforce least‑privilege IAM roles and policies, establish strong IAM Access Boundaries using Service Control Policies (SCPs), and govern inter‑service communication.
  • Network Segmentation:
    Design and implement robust network security controls within VPCs, including Security Groups, Network ACLs, and private connectivity (VPC Endpoints, Transit Gateway).
• Design and implement security best practices and tooling within AWS and EKS, including controls such as admission controllers, image scanning/signing, pod security standards, and runtime security enforcement.
• Develop and manage systems for continuous security control monitoring, reporting, and automated remediation (e.g., using AWS Config, Guard Duty, or custom tools).
• Develop threat models independently, or jointly with system owners. Translate identified threats into tangible security requirements, ensuring controls are strategically deployed to strengthen the security posture of core platforms and services.
• Serve as a principal security consultant to product and platform engineering teams, conducting in‑depth security design reviews for new systems and features, and proposing actionable security control implementations.

• 7+ years of progressive experience in software, platform, or security engineering, with a minimum of 3+ years focusing exclusively on public cloud security (AWS required).
• Experience in identifying and managing security risk, and the ability to…