Principal Cloud Security Engineer

Job Location s US-Remote

Our mission is to SAVE AND IMPROVE LIVES BY EMPOWERING HEALTHCARE CONSUMERS. Come be part of remarkable.

How you can make a difference

As a Principal Cloud Security Engineer, Product Security, you provide technical leadership for the security of the cloud environments that host Health Equity's products and platforms. Reporting to the VP, Head of Product Security, you design the posture management, policy-as-code guardrails, and automated controls that keep misconfigured and overexposed resources out of production across our environments.

You combine hands-on cloud engineering with sound architectural judgment. You define cloud security standards and reference architectures, build preventive and detective controls as code, and work with product and platform engineering teams so that secure patterns are the default path rather than a late-stage review. Your application security and threat modeling background keeps those controls tied to how Health Equity's products are built and how they could be attacked.

The standards, guardrails, and automation you establish reduce public attack surface, shorten the time from detection to remediation, and let engineering teams deliver securely with less manual effort, in support of Health Equity's responsibility to protect member data.

• Lead the architecture and ongoing evolution of cloud security posture management across a large multi-subscription estate, using CNAPP/CSPM tooling to surface public exposure, misconfiguration, and risk, and driving prioritized remediation with product and platform teams.
• Design and build policy-as-code preventive guardrails, including service control policies, Azure Policy, and infrastructure-as-code validation in CI/CD, that block non-compliant infrastructure before it reaches production while applying defense-in-depth.
• Own the security architecture for cloud landing zones and account and subscription provisioning, so that newly created environments inherit security baselines, guardrails, and logging by default.
• Build event-driven auto-remediation that enforces security and compliance baselines at scale, and define when automated action is appropriate and when human review is required.
• Lead network exposure reduction for customer-facing applications, including web application firewall rule management, tighter security group and network security group ingress, and a move toward private connectivity.
• Define and evolve the IAM strategy for Azure, AWS, and GCP including federated identity, standardized SSO, least privilege, conditional access, and reduction of standing privilege.
• Lead threat modeling and architecture reviews for high-risk, cloud-hosted products and migrations, and scope and coordinate third-party penetration tests and audits, translating findings into prioritized remediation plans for engineering and executive stakeholders.
• Partner with Application Security and Vulnerability Management to build code scanning, secret detection, dependency analysis, and software supply chain controls into developer workflows and release gates, and support external researcher and bug bounty programs through scope, triage, and remediation SLAs.
• Establish security guardrails, governance requirements, and secure-adoption policy for AI services and AI-enabled development tooling in cloud environments, including managed model guardrails and Model Context Protocol (MCP) security.
• Set technical direction, identify systemic risks, recommend strategic improvements, and mentor and guide security engineers while driving the evolution of team tools, practices, standards, and automation capabilities.

This role requires deep, hands-on experience securing production cloud environments at enterprise scale, combined with the architectural judgment that comes from an application security background and the ability to provide technical leadership across teams.

• Extensive experience architecting, building, and operating cloud security controls in production AWS and Azure environments, including multi-account and multi-subscription estates.
• Deep experience with CNAPP/CSPM platforms for posture management, exposure and attack-surface management, and risk-based prioritization of findings.
• Advanced proficiency with policy-as-code and preventive guardrails, such as SCPs, AWS Config rules, Cloud Formation Guard, Azure Policy, and…