Lead Engineer - Cloud Security (Cloud Security Platform & CSPM)

Target • Brooklyn Park, MN

7d • $132,000 - $238,000

About The Position

The Lead Engineer on Target's Cloud Security team is the senior technical owner of Target's Cloud Security Platform and cloud security posture management (CSPM) capability across public and private cloud environments. This hands-on individual contributor sets technical direction, standards, and roadmaps, and ensures that security controls are reliable, automated, and useful to developers. The role owns the platform's end-to-end engineering and production operation, including onboarding cloud accounts, projects, and workloads; configuring and tuning controls; managing access; and maintaining availability, performance, observability, capacity, upgrades, SLOs, and incident response.

The role owns the CSPM policy set and the lifecycle of platform findings, working with software developers to aggregate, deduplicate, enrich, attribute, and deliver posture signals to enterprise remediation dashboards with SLAs. Scope also spans adjacent CNAPP capabilities, including cloud workload, container and image, cloud identity and entitlement, and IaC posture findings. The Lead Engineer partners with Detection & Response, cloud and security teams, and product engineering to integrate telemetry, support incident response, coordinate governance and exceptions, and drive adoption across Target Tech.

The position treats the platform as a product, investing in automation, self-service, paved roads, developer experience, and continuous reduction of operational toil and false positives. The engineer leads multi-quarter initiatives from framing and design through rollout and steady-state operation, makes build-versus-buy decisions, contributes to vendor and contract discussions, communicates risks and progress to technical and senior leadership, and mentors engineers while promoting strong engineering and operational practices.

The position may be considered for Remote or Hybrid (Flex for Your Day) work arrangements, based on Target's needs. Work must be performed within the country of the primary work location unless otherwise prescribed by Target. Remote team members may travel to headquarters up to four times a year.

Requirements

• A four-year degree or equivalent work experience.
• At least 7 years of hands-on technology experience, with deep experience in cloud security and related disciplines such as cloud platform engineering, CSPM, Kubernetes, IaC/CI-CD, automation, identity, and detection/response integration.
• Experience as a senior individual contributor or technical lead owning a security or platform capability end-to-end at enterprise scale and setting technical direction for other engineers.
• Deep hands-on experience deploying, operating, and tuning a CSPM or CNAPP platform in a large multi-cloud environment, including account onboarding, policy authoring and tuning, exception management, and driving findings to remediation.
• Experience maintaining high CSPM signal-to-noise through policy tuning, disciplined suppression, ownership attribution, and SLA-based remediation.
• Experience operating production platforms with SLOs, on-call coverage, change management, and continuous-improvement practices.
• Experience delivering multi-quarter roadmaps from problem framing through rollout, adoption, and steady-state operation.
• Ability to make and explain pragmatic build-versus-buy decisions.
• Hands-on experience with public cloud and private cloud/Kubernetes environments at enterprise scale.
• Working knowledge of Kubernetes and admission controller frameworks.
• Strong working knowledge of infrastructure as code, such as Terraform, and policy as code, such as Rego, plus familiarity integrating policy and posture signals into CI/CD.
• Experience building and operating findings pipelines that integrate cloud security signals into enterprise remediation and governance platforms, with ownership attribution and SLAs.
• Experience integrating cloud telemetry into enterprise SIEM/SOAR pipelines.
• Experience using security tools and technologies across diverse environments and the technical depth to implement end-to-end solutions aligned with reference security architecture requirements.
• Hands-on experience integrating security tooling into developer workflows, including CI/CD, source control, and ticketing, at scale.
• Strong understanding of secure software development practices, network security fundamentals, and modern cloud-native architectures.
• Understanding of AI/ML and emerging security considerations, including surfacing and enforcing them through cloud security tooling.
• Automation-first mindset and hands-on fluency in at least one general-purpose language, such as Python or Go, with a record of building reusable platforms and paved roads.
• Strong cross-functional partnership skills and ability to align requirements, rollout plans, and operational ownership with security and product engineering teams.
• Ability to communicate work, risks, and tradeoffs to senior leadership and explain technical detail to staff engineers.
• Understanding of enterprise security management workflows, the current threat landscape, and common organizational security challenges.
• Working knowledge of security frameworks, standards, cloud threats, and best practices such as NIST, CIS Benchmarks, and ISO/IEC 27001.
• Excellent written and verbal communication and presentation skills.
• Curiosity, bias for action, and a builder's mindset.

Nice To Haves

• GCP experience is preferred.
• AWS or Azure experience is valued.

Responsibilities

• Serve as the senior technical lead and hands-on owner of Target's Cloud Security Platform and CSPM capability, setting technical direction, standards, and roadmap.
• Engineer, deploy, configure, tune, and operate the CSPM/CNAPP platform across public and private cloud environments, including onboarding accounts, projects, and workloads and managing RBAC and SSO.
• Operate the platform as a production system, managing availability, performance, observability, capacity, upgrades, SLOs, and outage response, including on-call participation.
• Own the CSPM policy set, including enabling, tuning, and suppressing rules based on Target's reference architecture, benchmarks, and environment.
• Partner with Cloud Security software developers to design findings pipelines that aggregate, deduplicate, enrich, and attribute CSPM and adjacent CNAPP findings and deliver them to remediation dashboards with SLAs.
• Reduce noise and false positives so findings reaching engineers are actionable.
• Extend platform ownership to adjacent CNAPP signals, including cloud workload, container/image, CIEM, and IaC posture, coordinating with owners of deeper IaC scanning, admission control, and SSPM controls.
• Partner with Detection & Response to turn posture and runtime findings into detections and support cloud incident response.
• Lead multi-quarter initiatives from problem framing and scoping through design, build, rollout, adoption, and ongoing operation.
• Make pragmatic build-versus-buy decisions and lead technical aspects of tool lifecycle, including evaluations, POCs, adoption, integrations, and vendor and contract discussions.
• Treat the platform as a product by investing in automation, self-service, and platform approaches that scale coverage and remediation with Target's cloud footprint.
• Reduce toil through paved roads, improved defaults, fewer one-off tickets, and faster developer feedback.
• Own the developer experience of platform findings and controls, including clear explanations, documented escape hatches, coordinated exception handling, and feedback loops with product engineering.
• Drive platform coverage and adoption across Target Tech, including onboarding, exception and governance workflows, and developer enablement.
• Integrate cloud security telemetry into enterprise SIEM/SOAR pipelines and remediation and governance systems.
• Partner with Cloud Platform, Identity Security, Network Security, Data Security, Detection & Response, Vulnerability Management, BISO, and product engineering on requirements, rollout plans, and operational ownership.
• Communicate roadmap, risk reduction, operational health, and tradeoffs to senior leadership and staff engineers.
• Mentor engineers and promote code quality, testing, code review, on-call hygiene, postmortems, and operational excellence.

Benefits

• Eligible team members and dependents may receive comprehensive medical, vision, dental, and life insurance benefits.
• 401(k).
• Employee discount.
• Short-term disability and long-term disability.
• Paid sick leave.
• Paid national holidays.
• Paid vacation.
• Other financial, education, and well-being benefits may be available to eligible team members.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior