Lead Engineer – Cloud Security (Security Governance)

Target • Brooklyn Park, NC

8d • Hybrid

About The Position

As a Lead Engineer on Target’s Cloud Security team, you will be the senior technical owner of engineering workflows and services that make cloud security governance practical at enterprise scale. You will translate approved security requirements into usable workflows, build reliable onboarding and exception-management capabilities, improve adoption through evidence and feedback, and partner with authorized decision owners so risks are reviewed and handled consistently. This is a hands-on individual-contributor role that sets technical direction for other engineers and works across Target to connect security intent with accountable decisions and action.

You will lead the design, implementation, and operation of cloud security governance capabilities, including exception lifecycles, security finding and remediation workflows, onboarding, integrations, automation, and transparent reporting. You will partner with Security Architecture and designated authorities, who retain policy and formal risk decisions; this role enables and records decisions but does not independently approve policy deviations or accept risk. You will also operate governance services as production capabilities, drive multi-quarter initiatives, mentor engineers, support assurance and leadership reviews, and continuously reduce toil for security and engineering teams.

The position is Hybrid/Flex for Your Day, with work performed both onsite at the assigned Target HQ Minnesota location and virtually, based on role, team, and task needs. Work duties may not be performed outside the country of the primary work location unless otherwise prescribed by Target.

Requirements

• A four-year degree or equivalent work experience.
• At least 7 years of hands-on experience in technology, security engineering, platform engineering, or a related discipline, including building or operating capabilities in a large, complex organization.
• Demonstrated experience as a senior individual contributor or tech lead owning a technical capability end-to-end at enterprise scale and setting technical direction for other engineers.
• Experience designing and improving security, risk, compliance, exception, or remediation workflows with clear ownership, decision paths, evidence, review periods, and closure.
• Strong understanding of security governance, including how requirements, controls, evidence, exceptions, risk decisions, remediation, and assurance work together to manage organizational risk.
• Experience building, integrating, or automating workflow-oriented services, APIs, data flows, or platforms; fluency in at least one general-purpose programming language and willingness to work hands-on in the team’s technology stack.
• Track record of converting complex requirements into clear processes, usable technical workflows, operational guidance, and measurable outcomes without confusing process completion with risk reduction.
• Experience driving adoption of security or platform capabilities across multiple engineering teams, including onboarding, enablement, support models, feedback, and continuous improvement.
• Sound judgment in exception handling, including gathering context, identifying missing information and potential compensating controls, explaining tradeoffs, and routing decisions to authorized owners without treating exceptions as automatically approved.
• Experience defining operational measures and reporting for workflow quality, adoption, control coverage, remediation, or service health; ability to establish trusted definitions and baselines before recommending targets.
• Experience with enterprise ticketing, governance, risk, compliance, asset, or security platforms and system integration through APIs, event streams, or data pipelines.
• Hands-on public cloud experience; GCP is preferred, while AWS and Azure experience are also valued.
• Familiarity with cloud security controls, findings, and engineering workflows.
• Working knowledge of security frameworks and standards such as NIST, CIS Benchmarks, ISO/IEC 27001, or CSA CCM, and experience mapping requirements to controls and evidence; ability to partner with Security Architecture and control owners rather than act as the policy authority.
• Track record of operating production services or business-critical workflows with observability, service objectives, change management, failure handling, and continuous-improvement practices.
• Ability to make and defend pragmatic build-versus-buy decisions and determine when to automate, use an existing enterprise capability, or improve the operating model.
• Strong cross-functional partnership skills, working with security, risk, product, platform, infrastructure, and service teams to align requirements, adoption plans, decisions, and operational ownership.
• Ability to represent work, risks, and tradeoffs to senior leadership and explain the same content in detail to staff engineers.
• Excellent written and verbal communication and presentation skills; ability to make security expectations and decision requests clear to technical and non-technical audiences.
• Curiosity, bias for action, and a builder’s mindset, with interest in improving and operating capabilities rather than only describing processes.

Nice To Haves

• Experience in cloud security, cybersecurity, security governance, GRC, or another risk-sensitive technology environment.
• Experience with cloud security posture management (CSPM/CNAPP), infrastructure-as-code scanning, Kubernetes admission controls, software supply chain controls, or related security capabilities.
• Experience designing exception workflows, policy lifecycle processes, control evidence models, or security finding-to-remediation programs.
• Experience with workflow automation, service management, governance/risk/compliance platforms, and enterprise reporting or analytics.
• Familiarity with cloud platforms and developer workflows, including source control, CI/CD, ticketing, and internal developer platforms.
• Experience with policy-as-code, infrastructure as code, data quality, or security control testing.

Responsibilities

• Serve as senior technical lead and hands-on owner of Cloud Security governance engineering, setting technical direction, standards, and a roadmap for workflows, integrations, and automation.
• Design, build, and operate a consistent cloud security exception lifecycle, including intake, completeness checks, context, risk and impact information, compensating controls, accountable decision ownership, review dates, expiry or renewal, and closure evidence.
• Route exception requests to appropriate policy, architecture, business, or risk-acceptance authorities; track decisions and conditions; and escalate overdue or incomplete requests through agreed paths.
• Engineer workflows connecting security findings, control requirements, exceptions, remediation ownership, service-level expectations, and closure evidence to enterprise governance and remediation systems.
• Lead onboarding and adoption of Cloud Security capabilities across eligible cloud accounts, projects, workloads, and engineering teams; define practical entry criteria, steps, ownership, enablement materials, support paths, and feedback loops with engineering partners.
• Improve onboarding and governance as products by reducing friction and one-off coordination through guidance, self-service, automation, reusable patterns, and well-defined service interfaces.
• Work with Security Architecture and domain owners to turn approved standards, control requirements, and policy changes into guidance, implementation handoffs, evidence expectations, and governance workflows.
• Establish transparent reporting for adoption, coverage, exception quality and age, review and expiry status, finding ownership, remediation progress, and workflow health; agree on populations, definitions, owners, and baselines before proposing targets.
• Improve governance data quality and usability by partnering with platform and software engineers, ITDP, service owners, and enterprise workflow owners on asset attribution, ownership, severity, business context, and status feedback.
• Build integrations and automation for intake, routing, notifications, evidence capture, status synchronization, and reporting; use enterprise capabilities where appropriate and make pragmatic build-versus-buy recommendations.
• Operate governance services as production capabilities, owning availability, performance, observability, capacity, change and release practices, failure handling, and on-call participation as appropriate.
• Establish service objectives for workflow reliability, completeness, and timeliness with stakeholders.
• Partner with Cloud Security platform and software engineers so policy enforcement, findings, onboarding, exceptions, and remediation provide a coherent end-to-end experience for engineering teams.
• Partner with Security Architecture, BISO/governance, Identity, Network, Data Protection, SecOps/Detection & Response, Vulnerability Management, ITDP, and product, platform, and service owners to clarify responsibilities, decision paths, service interfaces, and operational handoffs.
• Support audit, assurance, and leadership reviews by making approved control requirements, exception decisions, evidence, ownership, and remediation status discoverable and reliable; do not present working proposals or incomplete evidence as approved policy or established compliance.
• Drive multi-quarter initiatives end-to-end, from problem framing and scoping through design, build, rollout, adoption, and steady-state operation.
• Represent governance capabilities, risk themes, adoption barriers, exception trends, decision needs, workflow health, and tradeoffs to senior leadership and staff engineers in audience-appropriate language.
• Mentor engineers in security governance engineering, workflow automation, control evidence, and operational practices; raise standards for code quality, testing, code review, on-call hygiene, postmortems, and operational excellence.
• Continuously reduce toil for the Cloud Security team and Target’s engineering organization by reducing unclear requests, repeated approvals, manual status chases, and one-off onboarding paths while improving consistency, self-service, and timely feedback.

Benefits

• Eligible team members and dependents may receive comprehensive health benefits and programs, which may include medical, vision, dental, and life insurance.
• 401(k).
• Employee discount.
• Short-term disability.
• Long-term disability.
• Paid sick leave.
• Paid national holidays.
• Paid vacation.
• Financial, education, and well-being benefits for eligible team members.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior