Senior Software Engineer II, Cloud Security

Qualia•Austin, TX

About The Position

Qualia is hiring a Senior Cloud Security Engineer to build and operate security for the cloud infrastructure that supports its real estate transaction platform. The role covers AWS accounts and organization, Kubernetes clusters, identity and access to production, CI/CD systems, and security detection and response. Most of the work involves writing code and infrastructure, including Terraform modules, policy-as-code, Go services for detection and automation, and integrations into engineering workflows. The position is one of two engineers on the Cloud Security team and works with the team's EM, as well as closely with SRE, Platform, Application Security, and InfoSec. The role is based in Austin, Texas, with a hybrid option for those nearby and remote possibilities for qualified candidates. Qualia describes itself as a remote-first development organization.

Requirements

At least 6 years of experience in cloud security, infrastructure, SRE, or platform engineering, including at least 3 years focused on securing production cloud environments.
Deep hands-on AWS experience, including IAM policy evaluation, Organizations, VPC and private connectivity, KMS, CloudTrail, and GuardDuty or an equivalent.
Production Kubernetes security experience, including RBAC, admission control, network policy, pod security, and workload authentication to cloud APIs.
Strong Terraform or similar infrastructure-as-code skills, including writing and reviewing modules and building guardrails used by other teams.
Ability to write production code; Go is preferred, while Python or TypeScript is welcome if willing to work in Go.
Ability to explain how an attacker could move from a leaked credential or compromised pod to sensitive data and how to detect each step.
Clear, direct writing skills for actionable findings and design documents that stand up to review.

Nice To Haves

Experience in fintech, real estate technology, or another regulated, high-liability domain.
Cloud penetration testing, red team, or digital forensics and incident response experience.
Supply chain security experience, including artifact signing, SBOMs, or SLSA-style provenance in CI/CD.
Open-source security tooling, published research, or conference talks.

Responsibilities

Design and implement AWS account structure, IAM roles and permission boundaries, network segmentation, and KMS usage using Terraform and Go.
Secure Kubernetes by implementing admission policies, RBAC, network policies, workload identity, and runtime controls; keep container images minimal and patched.
Build hardened, reusable infrastructure-as-code modules and CI policy checks that make secure practices easy for engineers to follow.
Build and tune cloud detections using CloudTrail, Kubernetes audit logs, and runtime signals; develop the Go services and pipelines behind them and feed InfoSec's SIEM.
Implement just-in-time access, short-lived credentials, and secrets management for people, services, and CI.
Build and operate in-house posture checks in Go across AWS accounts and container images; fix root causes in code and automate recurring fixes.
Investigate cloud alerts, handle the infrastructure side of incidents, and address gaps to prevent recurrence.
Review infrastructure pull requests and design proposals, and pair with SRE and product engineers to implement fixes.