Security Engineer Attack Surface Platforms (Hybrid)

First American•Santa Ana, CA

18h•$97,700 - $130,300•Hybrid

About The Position

The Security Engineer – Attack Surface Platforms operates and improves the organization’s cloud native application protection platform (CNAPP) and related attack surface capabilities. The role reviews and triages findings, validates risk and ownership, coordinates remediation with cloud and application teams, and maintains the quality of platform policies, integrations, workflows, and reporting. It delivers tested, incremental enhancements that help teams identify and address cloud security exposure. The role is suited to candidates with a security or technology foundation who are interested in developing cloud security skills. The position partners with Cloud Engineering, Platform Engineering, DevOps, application teams, Security Operations, Security Architecture, other technology groups, and platform vendors to resolve exposure, troubleshoot issues, and maintain effective CNAPP operations. It communicates with technical and business stakeholders.

Requirements

Working knowledge of at least one major cloud platform, including its core services and terminology.
Understanding of CNAPP capabilities and related areas such as CSPM, CWPP, CIEM, vulnerability management, and container security.
Ability to interpret cloud assets, identities and permissions, network exposure, vulnerabilities, and configuration findings, and explain risk and remediation steps to engineering teams.
Experience with security operations practices such as alert or finding triage, ticket ownership, prioritization, escalation, remediation tracking, and evidence-based closure.
Ability to troubleshoot SaaS security platforms, integrations, data ingestion, policy behavior, access, and reporting issues with platform or cloud administrators.
Basic scripting or API experience in a language such as Python, PowerShell, or Bash.
Strong written and verbal communication, attention to detail, sound judgment when handling security findings, and ability to manage multiple operational priorities.
Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent practical experience.
Typically 2–3 years of experience in information security, cloud security, security operations, cloud engineering, or a related technical role.
Must hold an introductory cloud or cloud security certification at the time of selection. Accepted certifications include AWS Certified Cloud Practitioner, Microsoft Certified: Azure Fundamentals, Google Cloud Digital Leader, or CCSK from the Cloud Security Alliance. An equivalent foundational certification may be accepted with manager approval.

Nice To Haves

Experience across multiple cloud platforms.
Infrastructure as Code experience.
Experience supporting a CNAPP or comparable cloud security platform.

Responsibilities

Monitor CNAPP queues, dashboards, alerts, and platform health; review new and aging findings, identify duplicates or data quality issues, and route actionable items to appropriate owners.
Triage cloud misconfigurations, vulnerabilities, exposed assets, excessive permissions, and workload or container risks; validate severity using asset context, exploitability, business criticality, and available threat information.
Investigate findings by reviewing cloud configurations, resource relationships, platform evidence, logs, and metadata; document the technical basis, affected resources, recommended remediation, and applicable exceptions or compensating controls.
Coordinate remediation with engineering and service teams, track progress against service targets, follow up on overdue or recurring issues, validate fixes, and escalate material or time-sensitive exposure.
Administer and support CNAPP capabilities, including user and role access, cloud account and subscription onboarding, integrations, asset inventory, notification routes, policies, and platform settings.
Improve platform coverage and signal quality by tuning policies, adjusting thresholds, testing detections, and reviewing false positives, missed coverage, and recurring finding patterns.
Build and test modest platform enhancements such as custom policies, dashboards, reports, API-based utilities, workflow changes, or integrations; maintain change notes and procedures and follow change and release practices.
Prepare operational reporting on exposure trends, remediation status, platform coverage, finding quality, and service health; explain notable changes and data limitations.
Contribute to security risk assessments, cloud security reviews, incident investigations, and audit evidence requests involving CNAPP data or cloud attack surface exposure.
Maintain runbooks and knowledge articles for recurring operational tasks, share platform guidance with users, and improve support handoffs and repeatable triage practices.
Communicate and collaborate with technology and business stakeholders and work with platform vendors on troubleshooting or product capability evaluations.