Cloud Security Engineer

Gifthealth Inc•Columbus, OH

7d•$115,000 - $150,000

About The Position

We are seeking a Cloud Security Engineer to design, implement, and maintain security controls across the organization's cloud infrastructure and cloud-native technology environments. This position plays a key role in supporting the Information Security department and reports to the Director of Security, ensuring alignment with organizational goals, operational excellence, and compliance standards. This role partners with Infrastructure, Platform Engineering, DevOps, Software Engineering, IAM, and Security teams to establish secure cloud architectures, identify cloud risks, implement preventative controls, and continuously improve the organization's cloud security posture. The Cloud Security Engineer serves as the primary technical security resource for cloud infrastructure and helps ensure security controls are scalable, automated, and integrated into the way cloud environments are designed and operated.

Requirements

3+ years of experience in cloud engineering, cloud security, infrastructure engineering, DevOps, security engineering, or a related field.
Hands-on experience securing environments within at least one major public cloud platform.
Strong understanding of cloud IAM, networking, encryption, secrets management, logging and monitoring, compute and storage security, vulnerability management, and cloud-native security services.
Ability to secure workloads across a hybrid environment that spans direct cloud infrastructure (AWS) and externally managed platforms (e.g., Heroku, Snowflake).
Experience scripting or automating infrastructure and security activities, with an understanding of least privilege and cloud-native identity models.
Ability to evaluate cloud architectures and communicate security requirements clearly to technical teams.
Demonstrated application of the above Qualification
Must be able to work at a computer for extended periods
Must be able to communicate effectively, verbally and in writing, with infrastructure, engineering, and security stakeholders
Must be able to handle and access sensitive cloud infrastructure and security data in compliance with organizational data handling requirements
Must be able to respond to critical cloud security incidents outside standard working hours when required

Nice To Haves

Relevant AWS, cloud security, Kubernetes, or security certifications are a plus.
Strong AWS security experience, including multi-account cloud environments.
Experience with Kubernetes, containers, or serverless technologies.
Experience with Cloud Security Posture Management or Cloud-Native Application Protection platforms, and familiarity with CIS cloud benchmarks, NIST guidance, or other cloud security frameworks.
Familiarity with VPN architectures (Site-to-Site and client VPN) for secure remote and third-party access.
Experience implementing column-level masking, row-level security, or PHI field-level governance in analytics warehouses such as Snowflake or BigQuery.
Experience with Infrastructure-as-Code such as Terraform or CloudFormation and building preventative cloud guardrails using policies, automation, or IaC.
Experience working within regulated environments.

Responsibilities

Develop and maintain security standards and reference architectures for cloud environments.
Participate in architecture reviews for new cloud services, platforms, and major infrastructure changes.
Evaluate proposed architectures for security risks and recommend appropriate controls.
Establish secure patterns for cloud networking, identity, encryption, logging, storage, compute, and managed services.
Evaluate the security boundary between AWS-managed infrastructure and externally managed platforms (e.g., Heroku, Snowflake) to ensure consistent controls across both.
Identify insecure cloud configurations and excessive permissions.
Continuously assess cloud environments against established security standards and benchmarks.
Prioritize cloud security findings based on technical severity and business risk.
Partner with system owners to remediate cloud security findings.
Identify systemic issues that can be addressed through platform-level controls.
Work with IAM teams to establish least-privilege access models for cloud resources.
Review cloud roles, permissions, service accounts, and privileged access.
Identify excessive, unused, or risky cloud privileges.
Establish controls for administrative and privileged cloud access.
Support secure workload identity and service-to-service authentication patterns.
Develop security controls for: Compute workloads, Storage, Databases, Networking, Serverless services, VPN and remote access infrastructure (Site-to-Site and client VPN), Data warehouse platforms (e.g., Snowflake, BigQuery), APIs, Secrets and key management.
Establish secure configuration baselines.
Work with engineering teams to implement cloud security guardrails.
Ensure appropriate cloud logging and security telemetry is available for security monitoring.
Develop or assist with detections for suspicious cloud activity.
Partner with Security Operations to investigate cloud security events.
Improve visibility into administrative activity, authentication, workload behavior, and configuration changes.
Embed cloud security requirements into Infrastructure-as-Code.
Develop automated checks and preventative security controls.
Build reusable secure cloud modules and templates with engineering teams.
Use APIs, scripts, and cloud-native services to automate security processes.
Support vulnerability management across cloud infrastructure and workloads.
Identify vulnerable cloud resources, operating systems, containers, and services.
Coordinate remediation with infrastructure and engineering teams.
Help distinguish vulnerabilities requiring immediate remediation from findings better addressed through compensating controls or risk acceptance.
Develop and maintain cloud security standards and technical requirements.
Map cloud controls to applicable security and compliance requirements.
Provide technical evidence for audits and assessments when needed.
Evaluate new AI-enabled cloud services (e.g., Amazon Q) for security and data-handling implications before broader rollout.