Senior Cloud Security & DevSecOps Engineer

Pretium Enterprise Services • Scottsdale, AZ

3d • Hybrid

About The Position

Pretium Enterprise Services is seeking a Senior Cloud Security and DevSecOps Engineer to own cloud security engineering across the operating companies it supports. The initial priority is to assess and strengthen existing AWS and Azure environments, then embed preventive controls into infrastructure and software delivery and extend those patterns to additional operating companies. This is a hands-on role partnering with infrastructure, development, identity, security operations, data, and AI security teams to implement production controls and drive remediation through verified closure.

The position is hybrid, three days per week in the office. Scottsdale, Arizona is the preferred location; Dallas, Texas, Charlotte, North Carolina, and California are also considered. The role offers the opportunity to join a collegial, entrepreneurial firm committed to team members’ personal and professional growth and to maintaining a positive, encouraging work environment.

Requirements

• Demonstrated ownership of production cloud security and DevSecOps controls, including improvements personally designed, implemented, and operated.
• Ability to take ambiguous problems through assessment, delivery, and verified closure with limited direction.
• Bachelor’s degree in Computer Science, Cybersecurity, Information Security, Computer Engineering, Software Engineering, or Information Technology.
• Deep security expertise in AWS or Azure and practical production experience in the other, with the ability to deliver security improvements across both.
• Experience with organizational guardrails, networking, logging, encryption, and workload permissions.
• Proven experience assessing existing cloud environments, prioritizing exposures, and driving remediation through verified closure with infrastructure and development teams.
• Hands-on experience implementing and tuning security scanning in CI/CD, validating findings, reviewing application code, and helping developers implement fixes.
• Strong grounding in threat modeling, API security, authentication, and authorization.
• Strong scripting and API integration skills, such as Python or PowerShell, demonstrated through production automation with testing, error handling, monitoring, documentation, and safe rollback.
• Ability to author, review, test, and deploy infrastructure and policy changes through version-controlled workflows using tools such as Terraform, Bicep, or CloudFormation and GitHub Actions, GitLab CI/CD, or Azure DevOps.
• Ability to explain risk and operational tradeoffs, agree on remediation priorities, and secure control adoption across teams without direct reporting authority.

Nice To Haves

• Experience in multi-company, shared-services, or managed-services environments.
• Snowflake or Palantir security experience.
• Wiz experience.
• Container, Kubernetes, or serverless security experience.
• Software supply chain controls experience.
• Prior software development experience.
• Relevant cloud or security certifications.

Responsibilities

• Assess existing AWS and Azure environments, prioritize inherited security gaps, and deliver a phased remediation roadmap.
• Establish reusable security baselines and onboarding standards across supported operating companies.
• Build and maintain organization-level guardrails through AWS Organizations and Azure management groups using infrastructure as code and policy as code.
• Test and stage changes, detect configuration drift, and validate the ongoing effectiveness of controls.
• Identify cloud misconfigurations, exposed services, and excessive workload permissions; implement owned fixes and drive other changes through infrastructure and application owners, verifying closure.
• Establish controls for network exposure, encryption, secrets, and audit logging; partner with security operations to validate telemetry coverage and support investigations.
• Implement least-privilege workload permissions, service-to-service access, and secrets controls aligned with identity standards.
• Jointly review privileged cloud access with the identity team, which owns workforce identity, lifecycle, and IGA.
• Embed security throughout the software development lifecycle through threat modeling and architecture, API, and data-flow reviews.
• Review application and infrastructure code and help developers implement practical fixes.
• Implement and maintain application security tooling, including Aikido and SAST, DAST, and SCA capabilities.
• Integrate code, dependency, secrets, container, and infrastructure scanning into CI/CD; tune rules and validate findings and exploitability.
• Build reusable pipeline templates and risk-based release gates; secure build systems, deployment credentials, and artifacts, with provenance and software bill of materials controls where appropriate.
• Drive adoption of common controls across independent engineering teams.
• Track coverage and remediation outcomes, document justified exceptions for approval, and turn recurring issues into preventive controls.
• Partner with data teams to secure Snowflake and Palantir service identities, integrations, and pipelines, aligning permissions with approved identity standards.
• Partner with the AI Security Engineer to implement cloud, pipeline, and workload controls for AI-enabled applications and agents.
• Build and operate maintainable security automation and runbooks, including testing, error handling, failure monitoring, documentation, and safe rollback.

Benefits

• 401(k) plan with an employer match.
• Health, dental, vision, and life insurance.
• Paid Time Off (PTO).
• 11 firm holidays.
• Hybrid office/work-from-home arrangement.
• Eligible for an annual year-end bonus.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior