Senior Software Engineer II, Cloud Security

Qualia•Austin, TX

2d•Remote

About The Position

Qualia is hiring a Senior Cloud Security Engineer to build and secure the cloud infrastructure behind its digital real estate closing platform. The Cloud Security team is responsible for AWS accounts and organization, Kubernetes clusters, production identity and access, CI/CD systems, and cloud detection and response. The role works alongside Application Security, SRE, Platform, and InfoSec, with day-to-day collaboration with SRE and Platform. The engineer will be one of two Cloud Security engineers and will work with the team’s engineering manager; the AWS, Kubernetes, and production-access patterns they establish will guide the wider engineering organization. Most of the work involves writing code and infrastructure, including Terraform modules, policy-as-code, Go services for detection and automation, and integrations that support Qualia’s software delivery. Qualia is remote-first, with an Austin office and a hybrid option for nearby employees. The role is based in Austin, Texas, with remote possibilities open to qualified candidates.

Requirements

At least 6 years of experience in cloud security, infrastructure, SRE, or platform engineering, including at least 3 years focused on securing production cloud environments.
Deep hands-on AWS experience, including IAM policy evaluation, Organizations, VPC and private connectivity, KMS, CloudTrail, and GuardDuty or an equivalent.
Production Kubernetes security experience, including RBAC, admission control, network policy, pod security, and workload authentication to cloud APIs.
Strong Terraform or comparable infrastructure-as-code skills, including writing and reviewing modules and building guardrails used by other teams.
Ability to write production code; Go is preferred, with Python or TypeScript acceptable if willing to work in Go.
Ability to explain how an attacker could move from a leaked credential or compromised pod to sensitive data, and how to detect each step.
Clear, direct writing skills for actionable engineering findings and design documents that withstand review.

Nice To Haves

Experience in fintech, real estate technology, or another regulated, high-liability domain.
Cloud penetration testing, red team, or digital forensics and incident response experience.
Supply chain security experience, such as artifact signing, SBOMs, or SLSA-style provenance in CI/CD.
Open-source security tooling, published research, or conference talks.

Responsibilities

Design and implement AWS account structure, IAM roles and permission boundaries, network segmentation, and KMS usage using Terraform and Go.
Secure Kubernetes by implementing admission policies, RBAC, network policies, workload identity, and runtime controls, and by keeping container images minimal and patched.
Build hardened, reusable infrastructure-as-code modules and CI policy checks that make secure engineering practices easier to follow.
Build and tune cloud detections using CloudTrail, Kubernetes audit logs, and runtime signals; develop the Go services and pipelines behind them and feed InfoSec’s SIEM.
Implement just-in-time access, short-lived credentials, and secrets management for people, services, and CI.
Build and operate in-house Go posture checks across AWS accounts and container images; fix root causes in code and automate recurring fixes.
Investigate cloud alerts, handle the infrastructure side of incidents, and address gaps to prevent recurrence.
Review infrastructure pull requests and design proposals, and pair with SRE and product engineers to implement fixes.