Principal Cloud Security Engineer

HealthEquity•Remote,

5d•$159,000 - $210,500•Remote

About The Position

As a Principal Cloud Security Engineer, Product Security, you provide technical leadership for securing the cloud environments that host HealthEquity's products and platforms. Reporting to the VP, Head of Product Security, you design posture management, policy-as-code guardrails, and automated controls to prevent misconfigured and overexposed resources from reaching production. You combine hands-on cloud engineering with architectural judgment, defining cloud security standards and reference architectures and working with product and platform engineering teams to make secure patterns the default. Your application security and threat modeling background helps ensure controls address how HealthEquity's products are built and could be attacked. The standards, guardrails, and automation you establish reduce public attack surface, accelerate remediation, and help engineering teams deliver securely while protecting member data. This role leads cloud security posture management across a large multi-subscription estate; builds preventive and detective controls as code; secures landing zones, account and subscription provisioning, and network exposure; and defines cloud IAM strategy across Azure, AWS, and GCP. It also leads threat modeling and architecture reviews, coordinates penetration tests and audits, partners with Application Security and Vulnerability Management on developer workflow and software supply chain controls, and establishes secure-adoption policies for AI services and development tooling. The role sets technical direction, identifies systemic risks, recommends improvements, and mentors security engineers.

Requirements

12+ years of experience in cloud security, security engineering, application security, or a closely related discipline, including significant time securing production cloud environments.
Extensive experience architecting, building, and operating security controls in production AWS and Azure environments, including multi-account and multi-subscription estates.
Deep experience with CNAPP/CSPM platforms for posture management, exposure and attack-surface management, and risk-based prioritization.
Advanced proficiency with policy-as-code and preventive guardrails, such as SCPs, AWS Config rules, CloudFormation Guard, Azure Policy, and infrastructure-as-code security validation in CI/CD.
Strong working knowledge of AWS and Azure native security services, including Control Tower, Organizations, Security Hub, GuardDuty, Defender for Cloud, Sentinel, and cloud WAF and firewall services.
Experience designing and operating event-driven automated remediation and detection across a cloud estate.
Strong understanding of cloud network security, including security groups and NSGs, WAF, API gateways, and private connectivity patterns.
Proficiency in Python, PowerShell, and Bash for security automation and tooling.
Advanced knowledge of cloud IAM, including federated identity, SSO, SAML, OAuth 2.0, OIDC, least privilege, and conditional access.
Strong application security foundation, including threat modeling (STRIDE and attack trees), architectural security reviews, secure code review, OWASP Top 10, and CWE Top 25.
Experience building vulnerability management and software supply chain programs, including SAST, secret scanning, software composition analysis, and developer-oriented triage and prioritization workflows.
Working knowledge of security risks related to AI and LLM technologies, including model guardrails, MCP, and AI-assisted development tools, and controls for safe adoption.
Hands-on understanding of penetration testing and offensive security findings sufficient to scope engagements, evaluate results, and drive remediation.
Demonstrated experience architecting, delivering, and operating security solutions with broad organizational impact across a large cloud estate and many development teams.
Experience serving as a technical lead, mentoring engineers, and leading initiatives across cross-functional engineering and security teams without relying on direct authority.
Ability to influence technical direction and explain complex risks, tradeoffs, and findings to technical and non-technical audiences, including senior leaders.
Exceptional judgment in balancing security requirements with engineering practicality, business needs, and long-term platform strategy.

Nice To Haves

Experience defining and scaling security capabilities within CI/CD pipelines and developer workflows.
Experience designing and operating a bug bounty or vulnerability disclosure program.
Experience in healthcare, financial services, or another highly regulated industry.
Strong working knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar regulatory and security frameworks.
Relevant industry certifications such as AWS Certified Security - Specialty, Microsoft Azure security certifications, CCSP, CISSP, or comparable credentials.

Responsibilities

Lead the architecture and evolution of cloud security posture management across a large multi-subscription estate, using CNAPP/CSPM tooling to identify exposure, misconfiguration, and risk and drive prioritized remediation.
Design and build policy-as-code preventive guardrails, including service control policies, Azure Policy, and infrastructure-as-code validation in CI/CD, to block non-compliant infrastructure before production.
Own security architecture for cloud landing zones and account and subscription provisioning so new environments inherit security baselines, guardrails, and logging.
Build event-driven auto-remediation that enforces security and compliance baselines at scale, and determine when automated action or human review is appropriate.
Lead network exposure reduction for customer-facing applications, including WAF rule management, tighter security group and network security group ingress, and movement toward private connectivity.
Define and evolve IAM strategy for Azure, AWS, and GCP, including federated identity, standardized SSO, least privilege, conditional access, and reduced standing privilege.
Lead threat modeling and architecture reviews for high-risk cloud-hosted products and migrations; scope and coordinate third-party penetration tests and audits; and translate findings into prioritized remediation plans.
Partner with Application Security and Vulnerability Management to integrate code scanning, secret detection, dependency analysis, and software supply chain controls into developer workflows and release gates.
Support external researcher and bug bounty programs through scope, triage, and remediation SLAs.
Establish security guardrails, governance requirements, and secure-adoption policy for AI services and AI-enabled development tools in cloud environments, including managed model guardrails and MCP security.
Set technical direction, identify systemic risks, recommend strategic improvements, and mentor and guide security engineers.
Drive the evolution of team tools, practices, standards, and automation capabilities.