Senior Cloud Security Engineer

Altera • San Jose, CA

6d • $149,100 - $215,925 • Onsite

About The Position

The Senior Cloud Security Engineer is a hands-on technical lead responsible for designing, implementing, and improving security across the organization’s Microsoft Azure and Amazon Web Services (AWS) environments. The role partners with cloud platform, infrastructure, application, identity, and security operations teams to build secure cloud foundations, protect workloads and data, and make security controls repeatable through automation. The ideal candidate has practical knowledge of Azure and AWS security services and skills in cloud architecture, identity and access management, network security, detection and response, and infrastructure as code. Oracle Cloud Infrastructure (OCI) experience is a plus.

The engineer designs secure cloud architectures and standards, improves identity and access controls, and secures cloud platforms, networks, workloads, data, and infrastructure-as-code workflows. The role also improves monitoring, detection, and incident response; supports governance, risk, and compliance; and collaborates with and mentors engineering and security teams. The position is based in San Jose, California. The stated Bay Area salary range is $149,100–$215,925 USD, with incentive opportunities based on individual and company performance. The employer uses artificial intelligence to screen, assess, or select applicants. Applicants must be eligible for any required U.S. export authorizations.

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, Engineering, or a related field, or equivalent practical experience.
• 7+ years of experience in cloud security, cloud engineering, infrastructure security, security engineering, or a closely related discipline.
• Hands-on security engineering experience with both Microsoft Azure and AWS.
• Strong understanding of cloud identity and access management, including Azure RBAC, Microsoft Entra ID, AWS IAM, federation, privileged access, and workload identities.
• Experience designing or securing cloud networking, including segmentation, private connectivity, firewalls, routing, DNS, and internet exposure controls.
• Experience securing cloud compute, storage, databases, containers, Kubernetes, and/or serverless workloads.
• Practical experience with infrastructure as code and automated cloud deployment workflows.
• Experience with cloud logging, monitoring, security posture management, vulnerability management, and incident response.
• Understanding of encryption, key management, secrets management, certificate management, and data protection in cloud environments.
• Experience scripting or automating using Python, PowerShell, Bash, or similar languages.
• Applicants must be eligible for any required U.S. export authorizations.

Nice To Haves

• Experience with Oracle Cloud Infrastructure (OCI) security architecture, identity, networking, logging, or governance.
• Relevant certifications such as Microsoft Certified: Cybersecurity Architect Expert, Azure Security Engineer Associate, AWS Certified Security – Specialty, AWS Certified Solutions Architect, CCSP, CISSP, or equivalent.
• Experience with Microsoft Defender for Cloud, Microsoft Sentinel, AWS Security Hub, Amazon GuardDuty, AWS Config, or comparable cloud security platforms.
• Experience with Terraform, Bicep, CloudFormation, Open Policy Agent, Checkov, or other infrastructure-as-code and policy-as-code tools.
• Experience securing Kubernetes and container platforms, including managed cloud services such as AKS and EKS.
• Experience supporting multi-account, multi-subscription, multi-region, or hybrid cloud environments.
• Familiarity with frameworks and standards such as NIST CSF, NIST SP 800-53, CIS Benchmarks, ISO 27001, SOC 2, PCI DSS, or applicable industry requirements.
• Experience with cloud detection engineering, threat modeling, or cloud incident response.
• Experience applying zero-trust principles to cloud workloads and administrative access.

Responsibilities

• Design and implement secure Azure and AWS architectures, including landing zones, accounts and subscriptions, networking, shared services, and workload environments.
• Establish cloud security reference architectures, patterns, guardrails, and configuration standards.
• Review cloud designs and changes for security risks and recommend practical mitigations.
• Apply defense-in-depth across cloud identity, network, compute, storage, data, application, and management planes.
• Help teams adopt secure cloud-native services and architecture patterns.
• Design and improve cloud identity and access controls, including least-privilege roles, federation, privileged access, service identities, and workload authentication.
• Strengthen identity lifecycle, access reviews, and administrative access practices across Microsoft Entra ID, Azure, AWS IAM, and related identity providers.
• Reduce reliance on long-lived credentials through managed identities, workload identity federation, role assumption, and secure secrets management.
• Review policies and permissions for excessive privilege, unintended trust relationships, and cross-account or cross-tenant access risks.
• Partner with identity teams to improve conditional access, multifactor authentication, privileged access management, and identity threat monitoring.
• Secure cloud infrastructure and workloads, including virtual machines, containers, Kubernetes, serverless services, storage, databases, and managed platform services.
• Establish and maintain secure baseline configurations, configuration policies, and preventive controls for Azure and AWS.
• Implement cloud network security controls, including segmentation, routing safeguards, firewalls, private connectivity, egress controls, and protection of public-facing services.
• Improve encryption and key management practices for data at rest and in transit, including certificate management and key lifecycle controls.
• Help teams protect sensitive data through classification-aware controls, secure storage configuration, backup protection, and data access governance.
• Support risk-based vulnerability management for cloud workloads, images, packages, and exposed services, with clear ownership.
• Embed security controls into infrastructure-as-code workflows and develop reusable policy-as-code, templates, modules, and automated checks.
• Integrate security validation into CI/CD pipelines, including configuration analysis, secrets detection, image scanning, and deployment policy checks.
• Automate cloud security operations and evidence collection using scripts, APIs, and cloud-native services.
• Review automation for secure handling of credentials, permissions, state files, logs, and deployment identities.
• Improve cloud security visibility, logging, alerting, and detection across Azure and AWS.
• Configure and optimize cloud-native security and monitoring capabilities such as Microsoft Defender for Cloud, Microsoft Sentinel, AWS Security Hub, Amazon GuardDuty, AWS Config, and CloudTrail, as appropriate.
• Develop and tune detections for suspicious identity activity, risky configuration changes, anomalous access, exposed resources, and cloud control-plane threats.
• Partner with security operations and incident response teams to investigate cloud security events and improve response playbooks.
• Ensure critical logs are enabled, protected, retained, and accessible for investigation and compliance needs.
• Participate in cloud incident response, root-cause analysis, and follow-up remediation.
• Define cloud security policies, control objectives, configuration standards, and exception processes.
• Assess cloud environments against recognized security frameworks and organizational requirements, and track gaps through remediation.
• Support audit, regulatory, customer assurance, and risk assessment activities with accurate technical evidence.
• Maintain cloud asset, ownership, and risk visibility with platform and service teams.
• Evaluate cloud services and design changes for data residency, privacy, resilience, and shared-responsibility implications.
• Communicate cloud risks and mitigation options to engineers, service owners, and leadership.
• Collaborate with cloud platform, infrastructure, application engineering, data, identity, and security operations teams to solve security problems.
• Provide actionable guidance and coach teams on secure cloud design and operational practices.
• Document architectures, standards, implementation guidance, and operational procedures.
• Mentor other engineers and contribute to a culture of security ownership and continuous improvement.

Benefits

• Incentive opportunities that reward employees based on individual and company performance.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior