Software Engineer - Staff Cloud Security Engineer

Arena Intelligence, Inc. • Bay Area, CA

23h • Onsite

About The Position

Arena Intelligence is seeking a hands-on, staff-level cloud security engineer to build and improve controls that protect its cloud infrastructure. The role sets security requirements for workload identity, machine credentials, and cloud access across cloud and managed platforms, and implements those requirements in code. The engineer partners with platform, infrastructure, and product engineers to build controls into the infrastructure they operate. This position is onsite in Arena's San Francisco office and reports to the Head of Security.

Requirements

• At least 6 years of experience in security or infrastructure engineering, including at least 3 years focused on production cloud security.
• Deep, current, hands-on experience securing AWS, GCP, and Cloudflare, including the ability to describe recent work at a technical level.
• Prior ownership of cloud security decisions, including IAM and secrets design, and the ability to explain and reassess those decisions.
• Strong practical knowledge of workload identity, OIDC, workload identity federation, IAM design, and secret managers.
• Experience operating credential rotation in production, including rotating database or API credentials without an outage.
• Cloud detection and response experience, including writing detections, responding to alerts, and investigating events using cloud audit logs.
• Comfort with Terraform or a similar infrastructure-as-code tool and at least one automation language, such as Python, Go, or TypeScript.
• Experience securing build pipelines and CI/CD, such as GitHub Actions and deployment credentials.
• Hands-on use of AI tooling for building, scripting, or investigation, and sound judgment about its appropriate use in security workflows.
• Good risk judgment, including the ability to distinguish real exposures from theoretical ones.
• Comfort improving existing systems and documentation while keeping work moving.

Nice To Haves

• Experience securing serverless platforms such as Vercel.
• Experience securing infrastructure for AI agent runtimes or sandboxed code execution.
• Kubernetes security, Postgres access controls, or data platform security such as Databricks.
• Experience leading incident response in a cloud environment.
• Experience with compliance evidence for cloud controls, such as SOC 2 or ISO 27001.
• Experience as an early security hire at a fast-growing startup.
• Experience working with data protection requirements in logs and access controls.

Responsibilities

• Design the cloud identity model for workloads, including least-privilege IAM, workload identity federation, and short-lived credentials.
• Own machine secrets and credential rotation end to end, ensuring credentials have owners, reside in a central secret manager, and have tested rotation paths.
• Define and enforce rules for environment and service access, including outbound connections, environment separation, and boundaries around agent runtimes.
• Build detections and alerts for high-risk changes to cloud infrastructure and build systems, and document actionable response steps.
• Integrate cloud security checks into infrastructure code and build pipelines.
• Secure machine credentials and permissions used by source control, build pipelines, and cloud deployments.
• Assess technical access requested by vendors and managed platforms before onboarding.
• Lead technical response to cloud infrastructure security events and work with affected teams through recovery.
• Keep cloud security posture visible to engineering and leadership and continuously improve it.
• Participate in the security on-call rotation.

Benefits

• Comprehensive health and wellness benefits, including medical, dental, vision, and additional support programs.
• Opportunity to work on cutting-edge AI with a small, mission-driven team.
• A culture that values transparency, trust, and community impact.
• Competitive compensation aligned to the markets where team members are based.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed