Senior Cloud Security Engineer

Altera Semiconductor•San Jose, CA

1d•Onsite

About The Position

The Senior Cloud Security Engineer is a hands-on technical lead responsible for designing, implementing, and improving security across the organization’s Microsoft Azure and Amazon Web Services (AWS) environments. The role partners with cloud platform, infrastructure, application, identity, and security operations teams to build secure cloud foundations, protect workloads and data, and make security controls repeatable through automation. The position calls for practical expertise in Azure and AWS security services, cloud architecture, identity and access management, network security, detection and response, and infrastructure as code. Oracle Cloud Infrastructure (OCI) experience is a plus.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, Engineering, or a related field, or equivalent practical experience.
7+ years of experience in cloud security, cloud engineering, infrastructure security, security engineering, or a closely related discipline.
Demonstrated hands-on security engineering experience with both Microsoft Azure and AWS.
Strong understanding of cloud identity and access management, including Azure RBAC, Microsoft Entra ID, AWS IAM, federation, privileged access, and workload identities.
Experience designing or securing cloud networking, including segmentation, private connectivity, firewalls, routing, DNS, and internet exposure controls.
Experience securing cloud compute, storage, databases, containers, Kubernetes, and/or serverless workloads.
Practical experience with infrastructure as code and automated cloud deployment workflows.
Experience with cloud logging, monitoring, security posture management, vulnerability management, and incident response.
Understanding of encryption, key management, secrets management, certificate management, and data protection in cloud environments.
Experience in scripting or automating using languages such as Python, PowerShell, Bash, or similar.

Nice To Haves

Experience with Oracle Cloud Infrastructure (OCI) security architecture, identity, networking, logging, or governance.
Relevant certifications such as Microsoft Certified: Cybersecurity Architect Expert, Azure Security Engineer Associate, AWS Certified Security – Specialty, AWS Certified Solutions Architect, CCSP, CISSP, or equivalent.
Experience with Microsoft Defender for Cloud, Microsoft Sentinel, AWS Security Hub, Amazon GuardDuty, AWS Config, or comparable cloud security platforms.
Experience with Terraform, Bicep, CloudFormation, Open Policy Agent, Checkov, or other infrastructure-as-code and policy-as-code tools.
Experience securing Kubernetes and container platforms, including managed cloud services such as AKS and EKS.
Experience supporting multi-account, multi-subscription, multi-region, or hybrid cloud environments.
Familiarity with frameworks and standards such as NIST CSF, NIST SP 800-53, CIS Benchmarks, ISO 27001, SOC 2, PCI DSS, or applicable industry requirements.
Experience with cloud detection engineering, threat modeling, or cloud incident response.
Experience applying zero-trust principles to cloud workloads and administrative access.

Responsibilities

Design and implement secure Azure and AWS architectures, including landing zones, accounts and subscriptions, networking, shared services, and workload environments.
Establish cloud security reference architectures, patterns, guardrails, and configuration standards.
Review cloud designs and changes for security risks and recommend pragmatic mitigations.
Apply defense-in-depth across cloud identity, network, compute, storage, data, application, and management planes.
Help teams adopt secure cloud-native services and architecture patterns.
Design and improve cloud identity and access controls, including least-privilege roles, federation, privileged access, service identities, and workload authentication.
Strengthen identity lifecycle, access review, and administrative access practices across Microsoft Entra ID, Azure, AWS IAM, and related identity providers.
Reduce reliance on long-lived credentials through managed identities, workload identity federation, role assumption, and secure secrets management.
Review policies and permissions for excessive privilege, unintended trust relationships, and cross-account or cross-tenant access risks.
Partner with identity teams to improve conditional access, multifactor authentication, privileged access management, and identity threat monitoring.
Secure cloud infrastructure and workloads, including virtual machines, containers, Kubernetes, serverless services, storage, databases, and managed platform services.
Establish and maintain secure baseline configurations, configuration policies, and preventive controls for Azure and AWS.
Implement cloud network security controls such as segmentation, routing safeguards, firewalls, private connectivity, egress controls, and protection of public-facing services.
Improve encryption and key management for data at rest and in transit, including certificate management and key lifecycle controls.
Help teams protect sensitive data through classification-aware controls, secure storage configuration, backup protection, and data access governance.
Support vulnerability management for cloud workloads, images, packages, and exposed services using risk-based prioritization and clear ownership.
Embed security controls into infrastructure-as-code workflows using Terraform, Bicep, CloudFormation, or equivalent technologies.
Develop reusable policy-as-code, templates, modules, and automated checks to make secure configurations easier to adopt.
Integrate security validation into CI/CD pipelines, including configuration analysis, secrets detection, image scanning, and deployment policy checks.
Automate cloud security operations and evidence collection using scripts, APIs, and cloud-native services.
Review automation for secure handling of credentials, permissions, state files, logs, and deployment identities.
Improve cloud security visibility, logging, alerting, and detection across Azure and AWS.
Configure and optimize cloud-native security and monitoring capabilities, such as Microsoft Defender for Cloud, Microsoft Sentinel, AWS Security Hub, Amazon GuardDuty, AWS Config, and CloudTrail, as appropriate.
Develop and tune detections for suspicious identity activity, risky configuration changes, anomalous access, exposed resources, and cloud control-plane threats.
Partner with security operations and incident response teams to investigate cloud security events and improve response playbooks.
Ensure critical logs are enabled, protected, retained, and accessible for investigation and compliance needs.
Participate in cloud incident response, root-cause analysis, and follow-up remediation.
Define cloud security policies, control objectives, configuration standards, and exception processes.
Assess cloud environments against recognized security frameworks and organizational requirements, and track remediation of gaps.
Support audit, regulatory, customer assurance, and risk assessment activities with accurate technical evidence.
Maintain cloud asset, ownership, and risk visibility with platform and service teams.
Evaluate cloud services and design changes for data residency, privacy, resilience, and shared-responsibility implications.
Communicate cloud risks and mitigation options clearly to engineers, service owners, and leadership.
Partner with cloud platform, infrastructure, application engineering, data, identity, and security operations teams to solve security problems collaboratively.
Provide clear, actionable guidance and coach teams on secure cloud design and operational practices.
Document architectures, standards, implementation guidance, and operational procedures.
Mentor other engineers and contribute to a culture of security ownership and continuous improvement.