We areseekingan experienced, hands-on Staff Security Engineer with deepexpertisein securing large-scale cloud environments on AWS and GCP. The ideal candidate has spent years designing, building, and operating cloud security architectures and controls — IAM, network security, encryption, detection, and guardrails — and brings a working knowledge of securing AI/ML workloads as these become a growing part of our cloud estate. You will play a pivotal role in hardening our multi-account, multi-region cloud footprint and in extending proven cloud security practices to AI-powered services, including generative and agentic AI implementations.

Primary Responsibilities

• Design, implement, andoperatecloud security architectures across AWS and GCP: organization/account structures,SCPsand organization policies, IAM and permission boundaries, KMS and encryption strategy, VPC design and network segmentation.

• Build andmaintainpreventive and detective guardrails at scale —manageCSPM, security services (e.g., AWS Security Hub,GuardDuty, GCP Security CommandCenter), and automated remediation.

• Embed security into infrastructure-as-code pipelines (Terraform, CloudFormation): policy-as-code, pre-deployment scanning, drift detection, and secure module patterns.

• Secure container and Kubernetes workloads (EKS, GKE), including image supply chain, runtime controls, and workload identity.

• Own vulnerability management across the cloud estate: continuous discovery and asset inventory, cloud-native and agent-based scanning (workloads, containers, serverless), risk-based prioritization using exploitability and reachability context (e.g., EPSS, KEV, internet exposure), anddriving remediation with workload owners against defined SLAs.

• Conduct security risk assessments, security design reviews, and threatmodelingfor cloud workloads, including AI/ML services and applications.

• Extend cloud security controls to AI/ML platforms and services (e.g., AWS Bedrock,etc.) data protection, access control, endpoint and API security, and controls for agentic AI components such as MCP servers and tool integrations.

• Develop and enforce security standards, policies, and baselines for cloud and AI/ML technologies, and drive their adoption across engineering teams.

• Collaborate with DevOps, Platform, Data, and Engineering teams to integrate security throughout the SDLC and ML lifecycle.

• Support monitoring and response for security incidents involving cloud and AI/ML infrastructure, ensuring rapid containment and remediation.

Required Qualifications

• Bachelor's degree or equivalent practical experience.

• 10+ years of overall security engineering experience, including security assessments, security design reviews, and threatmodeling

• 6+ years of hands-on cloud security engineering experience on AWS and/or GCP, withdemonstrateddepth in at least one and workingproficiencyin the other.

• Provenproficiencydesigning and implementing cloud-native security controls at scale: IAM, KMS, VPC and network segmentation, encryption, logging and detection, and multi-account/multi-project governance.

• Hands-on experience with infrastructure-as-code (Terraform, CloudFormation) and security automation.

• Experience running cloud vulnerability management programs, including risk-based prioritization and remediation tracking across multi-account environments.

• Working knowledge of AI/ML security risks — data privacy, model and endpoint security, prompt injection and related LLM threat vectors — and the ability to assess and quantify these risks using frameworks such as NIST AI RMF, OWASP Top 10 for LLM Applications, and MITRE ATLAS.

• Excellent analytical, problem-solving, and communication skills.

Preferred Skills

• Certifications such as AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, or CISSP.

• Direct experience securing managed AI platforms, including guardrails, data isolation, and compliance automation for generative and agentic AI.

• Familiarity with adversarial ML techniques (evasion, poisoning, model inversion/extraction, jailbreak testing) and responsible AI practices.

• Experience with CNAPP, container security, and Kubernetes security tooling.

• Experience working in agile, multicultural, and cross-functional teams.

Soft Skills Required

• Strong interpersonal skills with excellent written and verbal communication.

• Uncompromising personal and professional integrity and ethics.

• Clear articulation of complex technical concepts to both technical and non-technical stakeholders.

• Creative and analytical thinking to navigate challenges and develop practical solutions.

• Sound, risk-informed judgment — evaluating situations logically to make decisions andanticipatepotential risks.

• Effective prioritization and deadline management while managing multiple stakeholders.