Description

Position Summary
Our client is contracting a Cloud Security Engineer to join our Enterprise Technology team. In this role, you will work directly with engineering and operations teams to design secure architectures primarily on AWS, with additional coverage of Azure and GCP; work with our Snowflake and Databricks administration teams to secure our data platforms; find and fix security gaps; and serve as the subject matter expert (SME) for cloud security best practices across our global technology organization.
You will build security into how our client runs cloud and data platforms. That includes reviewing designs and architectures early, assessing AWS accounts, workloads, and data platform environments for weaknesses, getting findings fixed, and giving engineers guidance they can use right away. You will weigh risk against delivery needs and explain the trade-offs plainly to technical and non-technical stakeholders.
You will partner with Platform Engineering, Cloud Operations, Data Engineering, Networking, and Security teams to set secure defaults, tighten platform and pipeline controls, and make sure solutions meet our client's security and regulatory requirements as a publicly traded asset manager.
The ideal candidate has the following skills and competencies:

• Hands-On Engineering: Writes code to automate security controls and is comfortable in DevOps environments: GitHub, CI/CD pipelines, and infrastructure-as-code.
• Cloud Security Architecture: Experience designing and reviewing secure AWS architectures, with a solid grasp of multi-account design, identity and access management, encryption, and threat modeling.
• Cross-Platform Security: Experience securing AWS-centric architectures that extend to Azure and GCP, and working with Snowflake and Databricks admin teams on identity federation, data access, and consistent policy across platforms.
• Subject Matter Expertise: Demonstrated track record of serving as a trusted cloud security advisor. Turns frameworks and standards into clear guidance for engineering, data, and operations teams.
• Communication: Able to explain security risk and recommendations to a range of stakeholders, and to build credibility with both technical and non-technical colleagues.
• Adaptability: Comfortable with ambiguity and committed to ongoing learning as cloud platforms, threats, and tooling, including AI-enabled development, keep changing.

Primary Responsibilities

• Find security issues across cloud and data platforms using posture assessments, reviews, and tools such as Wiz, then work with the owning teams to fix them and track each finding to closure.
• Act as the SME for cloud security, setting the standards and reference patterns that engineering and data teams follow.
• Define and implement security controls for AI tooling and platforms in the cloud, such as Amazon Bedrock, AI coding assistants, agent runtimes, and MCP integrations, covering model and data access, credentials and secrets, logging and monitoring, and guardrails.
• Define and promote secure-by-default patterns for AWS, covering account structure, identity, networking, encryption, and logging, and extend them to Azure and GCP.
• Harden containerized workloads on Amazon EKS and Kubernetes, setting guardrails for cluster configuration, workload identity, network policy, and container image and runtime security.
• Work with engineering and operations teams on architecture and design reviews and threat modeling for new and changing systems, mainly on AWS with some Azure and GCP.
• Design secure cross-platform integrations among AWS, Azure, GCP, Snowflake, and Databricks, including identity federation, private connectivity, data sharing, and access controls such as masking and classification.
• Build security controls into GitHub repositories, GitHub Actions pipelines, and Terraform code through automated scanning, policy-as-code, and guardrails.
• Assess new cloud services and platform capabilities, including data, analytics, and AI services, and recommend controls before broad adoption.
• Collaborate with Platform Engineering, Cloud Operations, Data Engineering, Networking, and Security teams so solutions are secure, compliant, and fit with existing infrastructure, and write documentation that helps engineers apply security guidance.

Requirements
Required Experience

• 7+ years in security engineering, security architecture, or cloud engineering with a security focus, including extensive hands-on AWS experience.
• Experience designing and reviewing secure architectures primarily on AWS, including threat modeling and security design reviews.
• Strong understanding of cloud security principles, identity and access management, network security, and secure defaults on cloud and data platforms.
• Strong hands-on experience securing AWS environments, including IAM, AWS Organizations and service control policies, VPC, KMS, EKS, CloudTrail, Security Hub, and GuardDuty.
• Hands-on experience securing Kubernetes workloads on Amazon EKS, including cluster hardening, RBAC and IAM roles for service accounts, network policies, and admission control.
• Hands-on experience with cloud security tooling such as Wiz, including posture management and attack path analysis, and routing findings to engineering teams.
• Proficiency with infrastructure as code (Terraform) and with at least one scripting or programming language (Python, TypeScript, Go, or similar) for security automation.
• Working knowledge of security frameworks such as NIST CSF, CIS Benchmarks, and ISO 27001.
• Commitment to ongoing learning as security threats and technology continue to evolve.

Preferred Experience

• Experience securing and operating AI tooling and platforms in the cloud, such as Amazon Bedrock, AI coding assistants, and MCP integrations.
• Working knowledge of securing Azure and GCP, Key Vault on Azure and Cloud IAM and VPC Service Controls on GCP, and designing secure connectivity and identity between AWS and those platforms.
• Strong experience with DevOps practices and automated CI/CD pipelines, including GitHub Enterprise and GitHub Actions, and building security into those pipelines with static and dynamic analysis, dependency scanning, and secrets scanning.

Education & Certificates

• Bachelor's degree or equivalent practical experience
• Concentration in Computer Science, Software Engineering, Information Technology, Cybersecurity, or similar discipline, strongly preferred
• Security certifications such as CISSP, CCSP, or GIAC preferred
• AWS Certified Security – Specialty or AWS Certified Solutions Architect strongly preferred; Microsoft Azure Security Engineer, Google Cloud security, Snowflake, or Databricks certifications a plus

Competencies & Attributes

• Strong problem-solving skills, with a track record of analyzing complex systems and identifying risk.
• Strong interpersonal and communication skills, with the ability to explain complex topics and present to both technical and non-technical audiences.
• Proven collaboration skills across multiple technology and project teams to deliver effective solutions.
• Ability to communicate clearly in presentations and written documentation.
• Ability to prioritize and deliver across competing demands

Key Skills

Education

Any Graduate