Cloud Security Architect

Description

This is a remote role for candidates based in the US. An in-person interview is required.

The company builds an identity security platform that covers both employee identities and the identities of AI and non-human accounts, aiming to remove blind spots. It is built on zero standing privilege and context-based risk, and large, complex organizations use it to run identity security at scale.

You will join the cybersecurity group's security engineers and report to the Director of Cyber Product Security.

The role sets the security architecture for the company's AWS, Azure, and GCP environments. You will work closely with engineering, DevOps, and IT so cloud security meets business goals and regulatory obligations.

The ideal candidate has deep technical skill and can turn security requirements into practical, scalable solutions.

The job includes shaping processes and technology, bringing in and building new capabilities, and maturing existing security activities.

You should already be comfortable with the company's four I's (individual, Impact, Innovation, and Integrity), even if the concept is new to you.

Responsibilities

• Design and build secure architectures for cloud infrastructure across IaaS, PaaS, and SaaS.
• Set and enforce cloud security standards, reference architectures, and guardrails covering landing zones, network segmentation, and identity boundaries.
• Lead security reviews of new cloud work and guide teams from design through deployment.
• Own the design and oversight of IAM, including least-privilege access, federation, and role-based access control.
• Work with the VM team and other Cyber teams to choose and roll out cloud-native and third-party tools such as CSPM, CWPP, CIEM, and SIEM/SOAR integrations.
• Work with DevOps and platform teams to build security into CI/CD pipelines, including DevSecOps practices and infrastructure as code scanning.
• Run threat models and risk assessments for cloud workloads and services.
• Make sure controls meet SOC 2, ISO 27001, NIST, and CIS Benchmarks where they apply.
• Write and maintain documentation, runbooks, and architecture diagrams for cloud security controls.
• Coach engineering teams on secure cloud design and act as a security subject-matter expert.
• Track emerging cloud threats, vulnerabilities, and vendor security features.
• First 90 days: finish onboarding and get access to cloud environments, tools, and key documents.
• First 90 days: assess the current cloud security posture to find gaps, quick wins, and high-risk areas.
• First 90 days: build relationships with engineering leads, DevOps, and IT.
• First 90 days: deliver an initial findings report with prioritized recommendations and begin fixing critical and high-severity findings.
• First 90 days: map the architecture, IAM structures, and network topology across cloud accounts and subscriptions.
• First 6 months: publish core cloud security reference architectures and standards for landing zones, network segmentation, and an IAM baseline.
• First 6 months: streamline security reviews for new cloud projects.
• First 6 months: reduce critical and high-risk findings from the initial assessment by a target percentage, for example 80%.
• First 6 months: add security checks to CI/CD pipelines with DevOps.
• First 6 months: run security architecture training or enablement sessions for engineering teams.
• First 6 months: show measurable gains in posture metrics such as CSPM score or open findings trend.
• First 12 months: meet the target compliance posture for SOC 2, ISO 27001, and other applicable cloud frameworks.
• First 12 months: make the architecture review process repeatable and scalable across engineering teams.
• First 12 months: build mature DevSecOps with automated security gates in CI/CD.
• First 12 months: become the go-to authority for cloud security architecture decisions.
• First 12 months: contribute to or lead the cloud security roadmap for the following year.
• First 12 months: show quantifiable risk reduction, such as shorter mean time to remediate and fewer exposed critical assets.
• First 12 months: mentor at least one team member or help grow security architecture skills across the team.

Requirements

• 5+ years in cloud security, security architecture, or related infrastructure security.
• Mandatory: hands-on experience securing workloads in AWS, Azure, and/or GCP.
• A solid grasp of IAM, network security, encryption, and key management in cloud environments.
• Experience with cloud security tools such as AWS Security Hub, Azure Defender, Prisma Cloud, Wiz, Orca Security, or similar CSPM/CWPP platforms.
• Proven experience securing containers and Kubernetes.
• Working knowledge of SOC 2, ISO 27001, NIST 800-53, and CIS Benchmarks.
• Experience with infrastructure as code and adding security to CI/CD pipelines.
• Preferred, not required: CCSP, AWS Certified Security - Specialty, Azure Security Engineer, or Google Professional Cloud Security Engineer certification.
• Technical depth: strong hands-on work with at least one major cloud provider. Working knowledge of multi-cloud concepts is a plus.
• Security architecture: designing defense-in-depth systems that balance security, cost, and performance.
• Automation: comfort with Terraform, CloudFormation, ARM/Bicep, and scripting in Python, Bash, or PowerShell.
• Communication: explaining complex security ideas to technical and non-technical people.
• Collaboration: a track record of working across functions with engineering and IT.
• Analysis: strong risk assessment and threat modeling.
• Adaptability: comfort in fast-changing settings with evolving cloud services and threats.
• Attack path analysis and exposure validation: ranking risk by how misconfigurations, vulnerabilities, and identity permissions combine into exploitable paths, not by viewing each finding alone.
• Leadership: influencing without direct authority and driving security practices across teams.

Conditions

US-based remote role with an in-person interview required.

Benefits and compensation vary by location and by the type of employment.

Benefits

• Base salary range for US-based employees: $174,200 to $293,702.00.
• The range is broad and placement depends on knowledge, skills, experience, market conditions, location, and internal peer equity.
• Base salaries for other locations are competitive for that location.
• Total compensation may include the Corporate Bonus Plan or a role-specific commission, and possibly equity participation.
• Medical, dental, and vision insurance.
• Health Savings Account with employer contribution.
• Flexible spending accounts for health care and dependent care, plus a limited-purpose account.
• Short-term and long-term disability coverage.
• Life insurance and AD&D, plus supplemental life coverage for employees, spouses, and children.
• 401(k) savings and investment plan with company matching.
• Flexible vacation policy, 8 paid holidays annually, and sick leave.
• Paid parental leave.
• Employee Assistance Program and Care Counselors.
• Voluntary legal assistance, critical illness, accident, hospital indemnity, and pet insurance.
• Career growth opportunities.