Lead Cloud Security Engineer

The Vanguard Group•Charlotte, PA

7d•Hybrid

About The Position

The Lead Cloud Security Engineer provides technical leadership and hands-on engineering for enterprise-scale cloud security controls at Vanguard. The role shapes how controls are designed, built, tested, shipped, and adopted across the organization, with success measured by technical coverage, control effectiveness, and platform trust. It supports reducing enterprise risk, enabling secure cloud adoption, and operationalizing cloud security strategy through engineering. The engineer designs and delivers solutions such as policy pipelines, event-driven remediation, and API contracts, emphasizing auditability, fault tolerance, and graceful degradation. They build preventive and detective controls as code, embed them into CI/CD pipelines and runtime configuration checks, automate posture checks and drift detection, and operationalize CSPM/CNAPP findings into enforceable controls. The position also translates security strategy, audit requirements, and risk priorities into technical work; supports privileged access controls, cloud account governance, audit responses, remediation, an on-call rotation, and special projects. The work is hands-on and uses AWS IAM and organization-scale AWS services, CloudFormation (and Terraform where appropriate), Python, policy-as-code tools such as Rego/OPA, AWS CLI and SDKs, and CI/CD systems. The role leads design reviews, establishes engineering standards, mentors and coaches engineers, resolves complex escalated issues, and influences technical practices across teams without direct authority. Vanguard uses a hybrid working model for the majority of its crew members, balancing flexibility with in-person learning, collaboration, and connection. Vanguard is not offering visa sponsorship for this position.

Requirements

At least seven years of related work experience.
Strong hands-on engineering ability, including writing and shipping production-grade code in Python or an equivalent language.
Heavy hands-on infrastructure-as-code experience; CloudFormation is used day to day, and Terraform is a plus.
Hands-on expertise in at least one of AWS, GCP, or Azure, at the level of organization-wide account structures, landing zones, and cross-account security patterns at scale; AWS is strongly preferred.
A track record of leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction across teams without direct authority.
Sound security judgment, including the ability to reason about trust boundaries, least privilege, blast radius, and risks caused by overly broad access.
Experience working directly with engineering teams on policy-as-code, CI/CD integrations, code repositories and pipelines such as GitHub, and cloud security tooling.
Experience operating in regulated or audit-driven environments.
An undergraduate degree in a related field, or an equivalent combination of training and experience.

Nice To Haves

Four or more years in cloud or security engineering is preferred.
Terraform experience.
Familiarity with AWS IAM policy mechanics, including inline and customer-managed policies, permission boundaries, SCPs, RCPs, and resource and identity policies; the posting notes this depth can be learned on the job.
Experience with AWS Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS.
Experience with CSPM or cloud governance platforms such as Wiz, and observability tools such as Splunk, Elastic, or Grafana.
Data skills including SQL, JSON, ETL, and Tableau or Power BI.
Multi-cloud exposure to GCP, Azure, or OCI.
Experience with PowerShell, PySpark, or AI-assisted tooling.
A relevant certification, such as AWS Security Specialty or a Professional-level AWS certification; not required.

Responsibilities

Lead technical design reviews and set standards for how security controls are built, tested, and shipped.
Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve complex issues elevated from staff.
Influence engineering patterns, best practices, and technical direction across teams without direct authority.
Design enterprise-scale solutions, including policy pipelines, event-driven remediation, and API contracts, with attention to auditability, fault tolerance, and graceful degradation.
Evaluate and select tools, frameworks, and integration patterns adopted by the broader team, including standards for integrating controls with CI/CD, identity providers, logging and observability, and CMDB/ITSM systems.
Move between solution design and hands-on implementation while staying close to the code.
Build preventive and detective controls as code; author, test, and stage-roll guardrails using infrastructure-as-code and policy-as-code.
Embed controls into CI/CD pipelines and runtime configuration checks, and determine whether each control should break builds or detect and alert.
Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology, including AI/ML where appropriate.
Engineer organization-scale preventive controls, including SCPs, RCPs, permission boundaries, resource and identity policies, and CI/CD guardrails, as well as detective controls.
Operationalize CSPM/CNAPP findings, such as Wiz findings, into enforceable automated controls.
Translate enterprise security strategy, audit requirements, and risk priorities into technical work, and measure control coverage and effectiveness.
Support privileged access controls and cloud account governance; contribute to audit responses, remediation, an on-call rotation, and special projects as needed.