Senior Engineer, Cloud Security

Workstreet

16d • Remote

About The Position

Workstreet is seeking a hands-on Senior Engineer, Cloud Security with deep cloud infrastructure engineering expertise, especially in Azure and multi-cloud architectures. The role focuses on designing and deploying security infrastructure, building hardened cloud landing zones, automating identity lifecycles, and creating reusable Terraform modules. It is an engineering position rather than an audit-assessment role.

The successful candidate will integrate quickly into client environments and take direct ownership of cloud security engineering, vulnerability remediation, and client engagements. Working with client engineering leads during U.S. Eastern Time business hours, the engineer will lead technical discussions, execute automated security operations, and help ensure cloud environments maintain drift-resistant, code-defined security. The position involves managing multiple client engagements and translating technical compliance requirements into practical cloud controls.

Requirements

• Deep technical expertise in cloud infrastructure engineering, with emphasis on Azure and AWS and the ability to distinguish compliance mappings from functional technical controls.
• Proficiency in Terraform, including module versioning, state management, and provider security controls.
• Demonstrated experience deploying security infrastructure, writing OPA policies, and managing secrets in Vault or AWS Secrets Manager.
• Deep understanding of SAML, OIDC, cross-account IAM roles, and enforcing least privilege without disrupting developer workflows.
• Strong verbal communication skills and the ability to lead technical workshops and explain complex architecture to engineering teams.
• Ability to work in fast-paced startup environments, balance multiple client priorities, and perform rapid remediation despite imperfect documentation.
• Excellent written and verbal English communication skills.
• Reliable, high-speed internet connection and a professional home office suitable for confidential conversations and uninterrupted collaboration.
• Commitment to a standard schedule of 8:00 AM–5:00 PM U.S. Eastern Time, with occasional flexibility for business priorities, global collaboration, and time-sensitive needs.
• Willingness and ability to travel locally for occasional onsite meetings, team gatherings, or business activities.
• Must be authorized to work in the U.S. without current or future visa sponsorship.
• Must participate in live video interviews with camera on and be prepared to verify identity during recruitment and onboarding; employment is contingent on identity verification and background screening, where permitted by law.

Nice To Haves

• Technical cloud security certifications such as AWS Certified Security Specialty, Azure Security Engineer Associate, or GCP Professional Security Engineer.
• Practical experience configuring and enforcing FIPS 140 standards across cloud services.
• Hands-on experience building CMMC-compliant enclaves or FedRAMP security architectures.
• Experience implementing container runtime security controls and vulnerability scanning across containerized environments.

Responsibilities

• Design and maintain reusable Terraform and CloudFormation modules for IAM, networking, and logging.
• Build and manage AWS multi-account structures, including Organizations and SCPs, and Azure Hub-Spoke and Landing Zone architectures.
• Implement least-privilege identity and access management using RBAC, ABAC, permission boundaries, JIT or PIM automation, and federated identity through Okta or Entra ID.
• Remediate cloud misconfigurations through engineering changes, automated patching, and configuration drift correction.
• Build automated remediation workflows using Lambda, Azure Functions, and Python.
• Integrate SAST, DAST, and secret scanning into GitHub Actions or Azure DevOps pipelines.
• Deploy and tune AWS GuardDuty, Security Hub, AWS Config, Microsoft Sentinel, and Defender for Cloud, and build native logging pipelines for SIEM ingestion.
• Design VPCs, security groups, network segmentation, and WAFs, and implement full-lifecycle encryption using AWS KMS and Azure Key Vault.
• Translate NIST 800-53, FedRAMP, and CMMC criteria into hands-on technical controls across cloud environments.
• Work directly with client engineering teams, lead architectural workshops, and manage multiple client engagements simultaneously.
• Deploy security infrastructure, write OPA policies, and manage secrets in Vault or AWS Secrets Manager.
• Participate in client-facing technical discussions and execute work during U.S. Eastern Time business hours.

Benefits

• Mentorship and training opportunities, with a clear career development path.
• Reimbursement for successful completion of approved training and certification courses relevant to the role.
• Competitive base salary with regular performance reviews linked to merit-based appraisals and bonus opportunities.
• Career advancement opportunities at an early-stage company.
• Remote-first work culture with flexibility to work from anywhere while collaborating with a global team.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed