Senior Security Engineer (FedRAMP)

About the role

We're seeking a Senior Security Engineer to support the development and growth of Veeam Data Cloud (VDC), our cloud-native SaaS platform. This role focuses on ensuring compliance and security in VDC's regulated environments, starting with FedRAMP boundaries and expanding to broader customer needs.

Responsibilities

• Champion secure design patterns that enable compliance-driven engineering across VDC’s Cloud environments, including VDC-wide standards such as supply chain security.
• Support the design and onboarding of new workloads into regulated environments from a security compliance perspective.
• Partner with VDC Engineering to harden shared infrastructure (e.g., VMs, containers, and operating systems) against secure baselines such as STIGs and CIS benchmarks.
• Oversee and support vulnerability scanning alongside the Platform team, providing remediation guidance and tracking fixes against SLAs.
• Support configuration management change control and configuration baseline compliance with Platform Engineering and SRE.
• Review significant architecture changes across our regulated environments and provide security input on approvals.
• Build reusable, framework-agnostic guardrails and evidence so security controls scale across FedRAMP, sovereign cloud, and emerging regulatory requirements.
• Review application and platform code and identify security deficiencies.
• Align commercial, government, and other product roadmaps so controls and standards carry cleanly across environments and frameworks.
• Participate in an on-call rotation shared across the Security Engineering team to respond, triage, and resolve alerts.

Requirements

• 6+ years in security engineering, with hands-on experience securing cloud environments (strong preference for experience in Azure and/or AWS).
• Experience delivering cloud products to meet regulated compliance requirements such as government (FedRAMP, CMMC, IL2/IL4/IL5, sovereign cloud), financial services (PCI-DSS), and/or healthcare (HIPAA, HITRUST).
• Ability to translate specific compliance controls into concrete architecture and operational decisions (e.g., how an audit logging requirement drives log retention design, or how boundary protection requirements shape network segmentation).
• Working knowledge of NIST 800-53, including continuous monitoring, vulnerability management, and configuration management standards.
• Strong understanding of cloud security fundamentals in identity, network boundaries, encryption, and vulnerability remediation domains.
• Ability to learn large, complex platforms quickly with limited guidance: Being comfortable building understanding from code, docs, and architecture artifacts.
• A collaborative, hands-on approach to partnering across engineering, product, security, compliance, and SRE.
• Deep partner mindset: Ability to take a hands-on approach to enable engineering teams rather than serving as gatekeepers.
• AI as a force multiplier: AI tools are woven into how we work, and we build security at AI-speed using these tools. We want engineers who treat AI as a force multiplier, not an afterthought.

Qualifications

• Experience designing and working with controls to satisfy requirements across multiple compliance frameworks.
• Hands-on experience with vulnerability scanning tools (e.g., Wiz, Nessus).
• Experience with IaC tools (e.g., Terraform).
• Experience using GitHub for configuration management and change control.
• Exposure to supply chain security standards and secure-by-design practices.
• Relevant certifications (e.g., CISSP, CCSP, or cloud provider security certs).