Lead Cloud Security Engineer Job Lees Pennsylvania USA,Software Development

The stack you'll work with:
Core — Hands-on day one

AWS IAM — roles, policies, trust and resource-policy patterns, permission boundaries, SCPs.
Cloud Formation (JSON/YAML) — heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits).
Python for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3).
CI/CD pipelines (Git Hub Actions, Bamboo, or similar) for building, testing, and shipping controls.
Core AWS at org scale — Organizations, IAM Identity Center, and services such as Lambda, Event Bridge, Step Functions, S3, API Gateway, and Cloud Watch.

Nice to have — or you'll pick up fast

Security-native AWS — Config, Secrets Manager, Cloud Trail, Access Analyzer, and KMS.
CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana).
Data skills (SQL and JSON, ETL, Tableau/Power BI).
Multi-cloud exposure (GCP, Azure, OCI).
Power Shell, PySpark, and AI-assisted tooling.

Core Responsibilities:

Technical Leadership

Lead technical design reviews and own the standards for how controls are built, tested, and shipped — raising the bar on code quality, systems thinking, and operational readiness.
Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff.
Influence engineering patterns and best practices across teams — driving technical direction beyond your immediate team, without direct authority.

Solution Design & Delivery

Design enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on — designing for auditability, fault tolerance, and graceful degradation when upstream systems change.
Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts — owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM).
Move fluidly between design and hands-on build; stay close to the code.

Automation & Infrastructure as Code

Build preventive and detective controls as code — author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (Cloud Formation and/or Terraform) and policy-as-code (Rego/OPA).
Embed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control.
Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate).

Security Engineering & Strategy

Engineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale.
Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls.
Translate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness.
Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed.

Qualifications:

Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred.
Strong hands-on engineering — writes and ships production-grade code (Python or equivalent — production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with Cloud Formation day to day (Terraform a plus).
Deep cloud expertise — hands-on experience across at least…