# Cloud Security Engineer

**Company:** [HappyRobot](https://hotfix.jobs/companies/happyrobot)
**Location:** Madrid, Spain, Barcelona, Spain
**Role:** Security Engineering
**Experience:** 4+ years
**Skills:** AWS, Azure, GCP, Wiz, Terraform, Opa/Rego, Checkov, Tfsec, Kubernetes, RBAC, Python, Go, EKS, Aks, GKE
**Posted:** 2026-08-06

> Own cloud security posture across AWS, Azure, and GCP by triaging CNAPP findings, enforcing Terraform policy-as-code guardrails, and hardening Kubernetes environments. The role requires 4–6 years of cloud or platform security experience, strong expertise in at least one major cloud, and hands-on remediation leadership.

## Job Description

## Responsibilities

### Cloud Posture Management
- Own the CNAPP end-to-end.
- Triage Wiz findings by exploitability and business impact.
- Drive remediation across engineering teams to SLA and prevent backlog accumulation.

### Infrastructure-as-Code Security
- Design and ship policy-as-code gates in the Terraform pipeline.
- Block misconfigurations at pull-request and plan time before they reach production.
- Use OPA/Rego, Checkov, tfsec, or equivalent tools.
- Calibrate security gates to prevent bad patterns without creating excessive friction.

### Multi-Cloud Security Baseline
- Define, document, and enforce a consistent security baseline across AWS, Azure, and GCP.
- Cover IAM, networking, KMS/encryption, and logging.
- Maintain documentation for enterprise customer security reviews and audit evidence requests.

### Kubernetes and Container Security
- Harden clusters, images, and admission paths across EKS, AKS, and GKE.
- Set and enforce RBAC policies, admission controls, and image-scanning standards.

### Remediation Leadership
- Drive fixes through engineering teams without direct management authority.
- Track SLAs, communicate risk to technical and non-technical stakeholders, and escalate when needed.

### Shift-Left Guardrails
- Increase the share of cloud infrastructure managed through Terraform with active security checks.
- Trend critical misconfigurations reaching production toward zero.

## Requirements
- 4–6 years of experience in cloud security or platform/infrastructure security.
- Expert depth in at least one major cloud provider: AWS, Azure, or GCP, including IAM, networking, KMS/encryption, and logging.
- Hands-on experience with a CNAPP/CSPM, preferably Wiz, including triage, prioritization, and remediation coordination with engineering teams.
- Production Terraform experience and policy-as-code experience with OPA/Rego, Checkov, tfsec, or similar tools integrated into CI/CD.
- Kubernetes security fundamentals, including RBAC, admission control, and image scanning.
- Scripting proficiency in Python or Go.
- English proficiency at B2 level or higher.

## Nice to Have
- Experience working across two or more cloud providers, including AWS, Azure, and GCP.
- CCSK, CKA, CKS, AWS Security Specialty, or equivalent certifications.
- EKS, AKS, or GKE hardening and container runtime security experience.
- TypeScript or advanced Go experience beyond scripting.
- SIEM and detection experience, including RunReveal.
- SOC 2 or ISO 27001 cloud-control evidence experience.

## Compensation and Benefits
- Competitive salary and equity in a high-growth startup.
- Healthcare, dental, and vision coverage.
- Ownership and autonomy over projects.

## Similar jobs

- [Platform Security Engineer](https://hotfix.jobs/jobs/e556dd76-0f95-4dfa-9d3d-e476f24057c0) - Supabase - Remote
- [Manager, Security Operations](https://hotfix.jobs/jobs/0a4637da-6072-4ec3-a0a9-8b6d4a412d45) - Vanta - Remote - $178k – $209k/yr
- [Senior Security Engineer, Offensive Security](https://hotfix.jobs/jobs/e6f5289c-9cb8-4a13-b321-e0ecc9a54c96) - Docker - Remote - €119k – €170k/yr
- [Senior Security GRC Analyst](https://hotfix.jobs/jobs/b54fb115-3bb7-4d88-8fdc-b7901d26d90d) - Monarch - Remote - $180k – $215k/yr
- [Security Engineer - Product](https://hotfix.jobs/jobs/d32dc9fa-f31b-4fc4-a7c6-eade39acfb64) - Wiz - Berlin, Germany

**Apply:** https://hotfix.jobs/jobs/373004cc-3695-4ff6-97d5-1c919a118190
**Canonical:** https://hotfix.jobs/jobs/373004cc-3695-4ff6-97d5-1c919a118190