Cloud Security Manager

Boeing•Seattle, WA

13d•Hybrid

About The Position

The Boeing Company is looking for a Cloud Security Manager to join the team in Seattle, WA; North Charleston, SC; Chicago, IL; El Segundo, CA; Mesa, AZ; Berkeley, MO; or Hazelwood, MO. We’re looking for a Cloud Security & Policy-as-Code Manager to lead a team of approximately 20 engineers and contractors. This team translates security, regulatory, and compliance requirements into automated, enforceable guardrails across multi-cloud and Kubernetes environments. This isn’t a compliance management role — it’s a technical leadership position. You’ll own the platform and the people that build, test, and deploy security policies as code. You’ll guide AI-powered policy tooling, drive threat modeling, and ensure your team delivers reliable guardrails at scale. You set direction, remove blockers, and provide architectural guidance so delivery teams can move quickly while meeting their security obligations. This role reports to the Sr Manager of Cloud Platform & Developer Experience.

Requirements

5+ years experience with Development Operations (DevOps) and/or Development Security Operations (DevSecOps)
5+ years experience leading or managing integrated or technical projects or teams across multiple computing platforms and organizations
3+ years experience implementing Policy As Code (Azure Policy, OPA/Gatekeeper, Rego, or equivalent)
3+ years experience with Infrastructure as Code tools such as Terraform, AWS CloudFormation, or ARM templates

Nice To Haves

Experience automating security and compliance controls in IaC and CI/CD pipelines (Terraform policy checks, pre-commit scanning, pipeline gates)
Coding proficiency (Python, Go, or similar) — enough to review PRs, guide architecture, and contribute when needed
Experience with IaC (Terraform, Pulumi, or similar) and integrating policy checks into CI/CD
Experience establishing or overseeing automated testing for security controls
Multi-cloud experience across AWS (Commercial + GovCloud), Azure (Commercial + Government), and GCP
Experience with AI/LLM capabilities and limitations; ability to guide teams building AI-assisted tooling
Experience with threat modeling methodologies (STRIDE, PASTA, or equivalent) and leading threat model reviews
Experience guiding teams that build AI-assisted developer tools or code generation pipelines with validation layers
Experience with LLM evaluation techniques, output validation, and confidence scoring
Experience with compliance frameworks (NIST, FedRAMP, SOC2) enough to translate requirements into code, not to run GRC programs
Experience managing mixed teams of FTEs and contractors
Background in Kubernetes security, admission controllers, and runtime policy enforcement

Responsibilities

Define and operate a unified guardrail framework across all five cloud environments using policy-as-code, admission controllers, and Terraform guardrails.
Drive continuous compliance automation that reduces manual audit effort through automated evidence collection and reporting.
Own drift detection, automated daily comparison of active cloud configurations against the policy repository, flagging gaps and triggering remediation.
Guide the development of AI-assisted policy generation using large language models to propose policies, identify control gaps, and draft Merge Requests with rationale.
Oversee Large Language Model (LLM) regression testing to validate accuracy when models are upgraded or swapped.
Establish monitoring for new Cloud Service Provider (CSP) service releases and documentation changes that triggers automated policy gap analysis.
Lead threat modeling for new platform capabilities, multi-cloud integrations, and Artificial Intelligence (AI) tooling.
Own Threat Model Review (TMR) approvals for system changes.
Maintain and extend threat models as new CSP integrations and AI components are introduced.
Lead, mentor, and grow a team spanning policy engineering, AI/ML tooling, and security automation.
Set engineering standards by code review, testing coverage, CI/CD quality gates, and documentation norms.
Build a culture where policies are treated as production software.
Manage contractor relationships, capacity planning, and delivery across multiple workstreams.
Collaborate cross-functionally with Cloud Foundations, Platform Acceleration, DevEx, Runtime SRE, and Enterprise Security.