Security Engineer Attack Surface Platforms (Hybrid)

First American•Santa Ana, CA

7d•Hybrid

About The Position

The Security Engineer – Attack Surface Platforms operates and improves the organization’s cloud native application protection platform (CNAPP) and related attack surface capabilities. The role reviews and triages findings, validates risk and ownership, coordinates remediation with cloud and application teams, and maintains the quality of platform policies, integrations, workflows, and reporting. It delivers tested, incremental enhancements to help teams identify and address cloud security exposure. The role is suited to internal candidates with a security or technology foundation and an interest in developing cloud security skills. The engineer partners with Cloud Engineering, Platform Engineering, DevOps, application teams, Security Operations, Security Architecture, and other technology groups to resolve exposure and maintain effective CNAPP operations. The position communicates with technical and business stakeholders and works with platform vendors to troubleshoot or evaluate product capabilities.

Requirements

Working knowledge of at least one major cloud platform, including core services and terminology.
Understanding of CNAPP capabilities and related areas such as CSPM, CWPP, CIEM, vulnerability management, and container security.
Ability to interpret cloud assets, identities and permissions, network exposure, vulnerabilities, and configuration findings, and explain risk and remediation steps to engineering teams.
Experience with security operations practices such as finding triage, ticket ownership, prioritization, escalation, remediation tracking, and evidence-based closure.
Ability to troubleshoot SaaS security platforms, integrations, data ingestion, policy behavior, access, and reporting issues with platform or cloud administrators.
Basic scripting or API experience in a language such as Python, PowerShell, or Bash.
Strong written and verbal communication, attention to detail, sound judgment when handling security findings, and ability to manage multiple operational priorities.
Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent practical experience.
Typically 2–3 years of experience in information security, cloud security, security operations, cloud engineering, or a related technical role.
Must hold an introductory cloud or cloud security certification at selection. Accepted certifications include AWS Certified Cloud Practitioner, Microsoft Certified: Azure Fundamentals, Google Cloud Digital Leader, or CCSK from the Cloud Security Alliance; an equivalent foundational certification may be accepted with manager approval.

Nice To Haves

Experience across multiple cloud platforms.
Infrastructure as Code experience.
Experience supporting a CNAPP or comparable cloud security platform.

Responsibilities

Monitor CNAPP queues, dashboards, alerts, and platform health; review new and aging findings, identify duplicates or data quality issues, and route actionable items to appropriate owners.
Triage cloud misconfigurations, vulnerabilities, exposed assets, excessive permissions, and workload or container risks; validate severity and recommend responses using asset context, exploitability, business criticality, and threat information.
Investigate findings by reviewing cloud configurations, resource relationships, platform evidence, logs, and metadata; document the technical basis, affected resources, recommended remediation, and applicable exceptions or compensating controls.
Coordinate remediation with engineering and service teams, track progress against agreed service targets, follow up on overdue or recurring issues, validate fixes, and escalate material or time-sensitive exposure.
Administer and support CNAPP capabilities, including access, cloud account and subscription onboarding, integrations, asset inventory, notification routes, policies, and platform settings.
Improve platform coverage and signal quality by tuning policies and thresholds, testing detections, and reviewing false positives, missed coverage, and recurring finding patterns.
Build and test modest platform enhancements, such as custom policies, dashboards, reports, API-based utilities, workflow changes, or integrations; maintain change notes and procedures and follow change and release practices.
Prepare operational reporting on exposure trends, remediation status, platform coverage, finding quality, and service health, explaining notable changes and data limitations.
Contribute to security risk assessments, cloud security reviews, incident investigations, and audit evidence requests involving CNAPP data or cloud attack surface exposure.
Maintain runbooks and knowledge articles, share platform guidance with users, and improve support handoffs and repeatable triage practices.