Staff Cloud Security Engineer

Responsibilities

• Maintain and iterate on Addepar’s Swiss AWS environment to enforce data locality restrictions and ensure core infrastructure is secure and operational.
• Integrate security best practices, policies, and solutions.
• Partner with the Swiss Infrastructure Operations team to maintain high security standards across the estate.
• Design and harden a multi-account AWS environment using Organizations, Control Tower, SCPs, custom tools, and guardrails.
• Design and build secure networking and private resource access patterns for human and programmatic use.
• Author and maintain Terraform code for security infrastructure and contribute to a secure Terraform module registry.
• Write and support CI checks using policy-as-code and infrastructure-as-code scanning.
• Automate vulnerability detection and remediation with native AWS technologies, event-driven architecture, and serverless workflows.
• Strengthen identity and secrets management through federation, role design, ABAC, IAM policy reviews, KMS strategy, Secrets Manager, and Parameter Store.
• Use discovery tools and cloud-native logging for investigations, resource discovery, and troubleshooting.
• Participate in infrastructure design reviews and cloud security assessments, producing clear and actionable reports.
• Partner with engineering teams to deliver secure business outcomes and measure impact through coverage, prevention, and response metrics.
• Act as an escalation point for the Security Operations Center.

Requirements

• Extensive security experience, including several years of hands-on experience building and securing AWS production environments and multi-account architectures.
• Bachelor’s degree in computer science or engineering, or equivalent practical experience.
• Clear written and verbal communication skills, with the ability to influence across teams and mentor others.
• Expertise in AWS security best practices and deep knowledge of native AWS services.
• Advanced Terraform experience, including module creation, remote execution environments, and integrating security checks into CI.
• Extensive experience with Python and boto3.
• Deep networking knowledge.
• Strong Linux, containers, Kubernetes, secrets management, and CI/CD fundamentals.
• Experience with policy-as-code, GitOps, and Zero Trust solutions.