Cloud Security Engineer
Position Overview
Job Title Cloud Security Engineer
Location Sunnyvale, CA (On-site, 5 days per week)
Duration 6+ Months, Contract-to-Hire
Interview Virtual
About the Role
Our client is a private physical AI and software development company that provides digital infrastructure and software tools to help manufacturers build, test, deploy, and operate intelligent moving machines.
We are seeking a highly focused Cloud Security Engineer to secure infrastructure across a diverse multi-cloud environment (AWS, Azure, GCP, OCI), with a heavy emphasis on Kubernetes cluster hardening. This role is driven by the client's environment architecture and deployment methodology.
Working alongside the Corporate Security & Infrastructure team, you will establish robust guardrails, enforce Identity and Access Management (IAM) policies, and maintain Cloud Security Posture Management (CSPM) to prevent insecure deployments and ensure continuous compliance.
Key Responsibilities
- Cloud Infrastructure Security: Securely deploy and maintain infrastructure across AWS, Azure, GCP, and OCI, establishing cloud-specific guardrails that prevent insecure deployments and configurations.
- Kubernetes Cluster Hardening: Implement and enforce security best practices for cloud-native Kubernetes clusters, including granular Role-Based Access Control (RBAC), network policies, and admission controllers.
- Identity & Access Management (IAM): Develop and enforce authentication and authorization policies across all systems. Manage identities across Active Directory, email platforms, and cloud solutions, and enforce least privilege at the cloud, cloud-service, and container levels.
- Container Security: Secure container images, registries, and runtime environments using Docker, Podman, and container scanning solutions.
- Infrastructure-as-Code (IaC) Security: Manage infrastructure and security policies in version-controlled Git repositories using Terraform, CloudFormation, or AWS CDK for consistent, auditable, and secure deployments.
- Cloud Security Posture Management (CSPM): Maintain CSPM tools such as Wiz to continuously detect and remediate misconfigurations and compliance drift.
- Compliance Automation: Automate compliance checks and generate audit evidence across the multi-cloud environment.
- Runtime Security: Monitor and protect running applications and containers from threats throughout their operational lifecycle.
Must-Have Requirements
Target Profile: Hands-on Multi-Cloud IAM & Cloud Security Engineer
- Multi-Cloud IAM: Strong AWS IAM plus hands-on IAM security experience in at least one of Azure Entra ID, GCP, or OCI.
- IAM Implementation: Personally designed and implemented IAM roles, custom policies, permission sets, least-privilege controls, service accounts, and access governance.
- IAM Standardization: Experience establishing and enforcing consistent security baselines across multiple cloud environments.
- Kubernetes Security: Hands-on implementation of Kubernetes RBAC, network policies, admission controllers, secrets management, and cluster hardening.
- Terraform: Strong experience implementing cloud security policies and guardrails through Infrastructure-as-Code.
- Multi-Cloud Networking: Practical experience with cloud networking and security controls.
- AI Security: Experience with AI-driven security identification, validation, or remediation.
- CSPM: Experience with Wiz or comparable tools, including actual vulnerability remediation.
Required Qualifications
- 5+ years of experience in software engineering or security engineering, focused on designing and building secure, production-grade cloud systems.
- Extensive, demonstrable Kubernetes security experience, including securing containerized workloads, enforcing RBAC, and cloud-native secret management.
- Proven use of AI to rapidly identify, validate, and remediate security issues without impact to operations.
- Deep operational security experience with AWS (mandatory); practical experience deploying and securing Azure, GCP, or OCI is highly preferred.
- Proficiency with Infrastructure-as-Code tools such as Terraform, CloudFormation, or AWS CDK.
- Hands-on expertise configuring, monitoring, and driving remediation through CSPM platforms such as Wiz.
- Strong background designing and enforcing complex IAM and least-privilege architectures across multi-cloud and on-premises directory environments.
- Experience with container security, image scanning, and runtime protection tools.
Nice to Have
- Advanced cloud and container security certifications, such as AWS Certified Security Specialty, Certified Kubernetes Security Specialist (CKS), or Certified Kubernetes Administrator (CKA).
- Strong programming or scripting skills for security automation and backend development (Go/Golang, Python, or C++).
- Experience automating compliance frameworks and generating audit evidence across a multi-cloud footprint.
- Experience securing and operating air-gapped or highly constrained on-premises environments.