Staff Security Engineer, Cloud and Product Security

Responsibilities

• Own security engineering across AWS cloud infrastructure, detection and response, application and product security, incident response, penetration testing, and security automation.
• Lead AWS security posture management, CNAPP initiatives, cloud misconfiguration risk reduction, infrastructure security reviews across Terraform and Nomad, and Cloudflare edge/WAF strategy.
• Build and operate a high-signal detection engineering practice on the SIEM, including alert triage ownership, runbooks, severity criteria, and false-positive reduction.
• Lead security incident response, escalation paths, tabletop exercises, and post-incident reviews; partner with IT on endpoint detection and vulnerability coverage.
• Own vulnerability management across SCA, SAST, DAST, and container scanning.
• Manage and mentor an application security contractor and route remediation work effectively into engineering teams.
• Conduct threat modeling and security architecture reviews for new products and significant changes.
• Improve secure SDLC practices and apply AI to security operations where it provides leverage.
• Own technical execution of the annual independent penetration test, including scope, findings triage, remediation routing, and retest coordination.
• Produce technical evidence supporting SOC 2, HIPAA, and Microsoft SSPA requirements without owning the audit or compliance program.
• Build security tooling and automation and ship security improvements through collaboration with Platform, Logistics, IT, and engineering teams.

Requirements

• 8+ years of security engineering experience with meaningful depth in cloud security.
• Hands-on expertise with AWS security services, IAM design, and infrastructure as code.
• Demonstrated detection engineering experience, including writing and tuning detections and reducing false positives.
• Real incident response experience as a responder or lead.
• Application security fluency sufficient to review findings, assess severity, and evaluate exploitability with engineers.
• Track record of delivering security improvements through other teams by building trust.
• Ability to serve as the senior technical security voice in an organization without a large security team.

Nice-to-haves

• Experience supporting SOC 2 Type 2, HIPAA, or Microsoft SSPA from the engineering side.
• Container and orchestration security experience, particularly with Nomad or Kubernetes.
• Cloudflare experience, including Zero Trust and WAF.
• Experience working with regulated or consumer-identifiable data at scale.
• Prior experience mentoring or managing engineers or contractors.

Compensation

• Annual base salary: $197,500–$220,000, plus RSUs.
• Remote working opportunities are available in specified U.S. states.