Staff Engineer, Cloud Security

Toast

8d•$151,000 - $309,000•Hybrid

About The Position

Toast is seeking a Staff Engineer, Cloud Security, to expand the scope and coverage of its cloud security capabilities. The role joins an existing cloud security team and helps set the direction for securing Toast’s cloud environments, primarily on AWS. It combines hands-on engineering—building and operating security tooling and controls—with technical leadership, strategy-setting, mentorship, and influence across engineering roadmaps. The position works closely with Platform and Infrastructure teams in R&D, as well as Defense & Response and other Security Engineering teams within Trust & Security. The role leads cloud security posture and identity improvements, secures container environments, builds security into infrastructure and deployment workflows, and partners with engineering and SOC teams to improve prevention, detection, remediation, and incident response. It also sets multi-year cloud security direction and develops trusted relationships with engineering leaders.

Requirements

At least 8 years of experience in security engineering, infrastructure, or software engineering, with significant time focused on cloud security.
Deep, hands-on experience securing AWS environments at scale, including IAM, Organizations, networking, logging, and core security services.
Experience deploying and operating cloud security tooling, such as CNAPP or CSPM platforms.
Experience with container and Kubernetes security, such as EKS.
Experience performing threat modeling and security architecture reviews for cloud services and platform capabilities.
Experience responding to security incidents in cloud environments.
Proficiency with infrastructure as code, such as Terraform, and at least one programming language used for automation, such as Python or Go.
Track record of leading cross-team technical initiatives and influencing engineering teams without direct authority.
History of setting technical direction for a security domain, including a multi-year roadmap and the decisions behind it.
Clear written and verbal communication, including the ability to explain risk and tradeoffs to engineers and leaders.

Nice To Haves

Experience with GCP, Azure, or other cloud platforms.
Experience with cloud detection engineering or incident response in cloud environments.
Familiarity with compliance frameworks relevant to payments and SaaS, such as PCI DSS or SOC 2.
Relevant certifications, such as AWS Certified Security Specialty or CCSP.
Experience mentoring engineers or growing a security function.

Responsibilities

Own and operate the Cloud-Native Application Protection Platform (CNAPP), including tuning, coverage, integrations, and converting findings into prioritized, actionable engineering work.
Lead cloud security posture management (CSPM) across the AWS organization and accounts by defining standards and measuring adherence over time.
Drive identity and access management improvements, including least privilege, role and permission design, and reducing standing access.
Secure container environments, including image and workload security, cluster configuration, and runtime protection.
Build guardrails and secure defaults into infrastructure as code and deployment pipelines.
Perform secure architecture reviews and threat modeling for new and existing cloud services and platform capabilities.
Partner with the SOC on cloud detection coverage, logging, and investigation readiness.
Run and improve cloud vulnerability and misconfiguration remediation programs in partnership with engineering owners.
Participate in security incident response, including on-call coverage, and lead cloud investigations and follow-up work.
Set the multi-year direction for cloud security at Toast.
Mentor and uplevel other engineers on the team.
Build trusted relationships with Platform, Infrastructure, and product engineering leaders, and influence their priorities through data and clear risk communication.