Senior Cloud Security Engineer

Tessera Labs

1d•$190,000 - $215,000•Remote

About The Position

The Senior Cloud Security Engineer will make the company’s cloud environments secure by default by designing and building guardrails, automation, and detection across multiple cloud providers. The role uses a DevOps approach: writing code, shipping changes through engineering pipelines, and creating reusable paved roads that teams will adopt. It partners closely with platform and infrastructure engineering, customer support, delivery teams, IT, and compliance. The engineer will own cloud security posture across AWS, GCP, and Azure; develop secure reference architectures and reusable patterns; integrate security into Infrastructure as Code and CI/CD; and establish least-privilege identity and access controls. The role also automates controls, remediation, and evidence collection; operates cloud security posture and native security services; builds logging and detection; leads the cloud side of incident response; and contributes controls and evidence to compliance programs such as SOC 2 and ISO 27001. Within the first 90 days, the engineer is expected to map the cloud footprint and prioritize risks, establish guardrails, centralized logging, and posture monitoring across accounts and projects, route findings to owning teams, and ensure security checks run automatically on infrastructure changes in CI/CD. The position is remote in North America.

Requirements

Experience in a DevOps, SRE, or platform engineering role, including personally building and operating production infrastructure and CI/CD pipelines.
Hands-on production experience securing at least two of AWS, GCP, and Azure, with an understanding of differences in their identity, networking, and logging models.
Deep knowledge of cloud security best practices, such as CIS Benchmarks and cloud-provider security foundations guidance, and the judgment to apply them pragmatically.
Fluency in cloud security patterns including least-privilege IAM and workload identity, network segmentation and private connectivity, encryption and key management, secrets management, centralized logging, and preventive guardrails.
Strong coding and scripting skills in at least one general-purpose language, such as Python or Go, plus shell scripting.
Hands-on experience with IaC, such as Terraform or OpenTofu, and embedding security checks into it.
Strong communication skills and the ability to explain risk to engineers in actionable terms.

Nice To Haves

Familiarity with open-source cloud security tools such as Prowler, Checkov, Trivy, OPA, or Falco.
Container and Kubernetes security experience, including admission control and runtime policy for EKS, GKE, or AKS.
A relevant cloud security certification, such as AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, Microsoft Azure Security Engineer Associate, or CCSP.
Experience securing SaaS and developer platforms, such as identity providers and GitHub organizations.
Experience supporting a SOC 2, ISO 27001, or similar program, including compliance automation platforms.
Hands-on cloud incident response or forensics experience.

Responsibilities

Own the security posture of cloud environments across AWS, GCP, and Azure, applying consistent controls.
Design secure reference architectures and reusable patterns for account and project structure, network segmentation, encryption and key management, and secrets management.
Build security into Infrastructure as Code using hardened modules, policy as code, and pre-deploy checks.
Secure CI/CD pipelines and the software supply chain, including pipeline permissions, secrets handling, artifact integrity, and short-lived workload identity.
Design and enforce least-privilege IAM across cloud providers, including role design, identity-provider federation, and periodic access reviews.
Write code and scripts to automate security controls, remediation, and evidence collection.
Operate and tune CSPM and cloud-native security services, and drive findings through remediation with owning teams.
Build logging and detection for cloud control-plane and workload activity, and lead the cloud side of incident response.
Contribute security controls and evidence to compliance programs such as SOC 2 and ISO 27001.
Map the cloud footprint, identify priority risks, and develop a remediation plan during the first 90 days.
Establish baseline guardrails, centralized logging, and posture monitoring across cloud accounts and projects, routing findings to their owning teams.
Implement automated security checks on infrastructure changes in CI/CD and help engineers engage security early on new infrastructure work.