Senior Cloud Security Engineer

About the role

This is a senior level security engineer role and they expect to see candidates who have supported application firewalls and security automation for enterprise level companies developing software in AWS environments. This person will be the center point of security to support all app teams with this subject matter – support automations (Python, JavaScript, AWS CDK and Cloud Formation).

Responsibilities

• Build and scale cloud security capabilities
• Design and deliver cloud-native security solutions that enhance visibility, strengthen protection controls, and enable automated detection and remediation across AWS and SaaS environments
• Develop code and infrastructure as code to operationalize security controls using modern tooling and automation frameworks
• Design, deploy, and manage highly available, secure, and scalable cloud security services running in production
• Integrate security capabilities into CI/CD pipelines and engineering workflows to make secure implementation the default
• Partner across and beyond the Information Security organization to turn risk priorities and detection gaps into engineered solutions
• Research, prototype, and validate new approaches, then carry them through architecture, documentation, and full production implementation
• Provide risk assessments and data-driven recommendations that influence engineering and security decisions
• Identify systemic security weaknesses and implement durable, automated fixes that reduce recurring risk
• Strengthen reusable cloud security patterns, reference architectures, and automation frameworks to increase consistency and speed
• Operate and continuously improve security tooling and services, including tuning, upgrades, and integrations
• Contribute to forward-looking design within AWS to enhance resilience, observability, and operational maturity
• Evaluate and promote new security standards, tools, and automation approaches that increase scale and effectiveness

Requirements

Practical experience working in AWS environments, including investigating activity using telemetry such as CloudTrail, IAM logs, VPC Flow Logs, and CloudWatch.

Experience writing and tuning SIEM queries and detections, with a strong understanding of how to improve signal-to-noise and reduce false positives.

Experience with Sumo Logic is a plus.

Experience executing structured threat hunts, including forming hypotheses, analyzing data, documenting findings, and recommending actionable improvements.

Experience supporting incident response activities, including log analysis, impact scoping, and clear documentation of findings and remediation steps.

Familiarity with attacker behaviors and frameworks such as MITRE Telecommunication&CK, and the ability to apply them in practical detection and investigation scenarios.

Working knowledge of scripting or automation using tools such as Python, PowerShell, or Bash to improve efficiency in investigations and reporting.

Strong written and verbal communication skills, including the ability to produce clear investigation summaries and collaborate effectively with technical teams.

A collaborative mindset, curiosity about emerging threats, and a desire to continuously improve detection quality and response effectiveness.

Ability to travel 1-3 times per year to client's offices.

Authorization to work in the United States.

Nice to have:

• Experience participating in purple team exercises or detection validation activities.
• Relevant certifications such as Security+, GCIA, GCIH, or AWS Security Specialty.
• Exposure to modern cloud-native architectures such as containers, serverless, or CI/CD pipelines.