Cloud Security Engineer

Description

The company is an energy business active from oil through to power, renewables and carbon, and it is hiring a Cloud Security Engineer for its Technology department.

You will keep the company's AWS and Google Cloud (GCP) environments, and the workloads running on them, secure across worldwide trading and physical operations.

The role connects security requirements with how cloud services are built and run, helping engineers ship quickly and safely.

You will work with the CISO organization, Developer Community Enablement, product engineering and local infrastructure teams around the world.

The company operates from 40+ offices and has committed over $2 billion of capital to renewable projects so far, while it develops low-carbon opportunities worldwide. The team spans more than 65 nationalities.

Responsibilities

• Design, deploy and run controls across AWS and GCP for posture management (CSPM), workload protection (CWPP), identity and entitlements (CIEM) and network security.
• Operate cloud security platforms such as Wiz, CrowdStrike Cloud Security and Palo Alto Networks: connect accounts and projects, adjust policies and send findings into existing workflows.
• Set and maintain secure baselines for AWS accounts and GCP projects, covering organization policies, IAM, encryption, logging and network segmentation.
• Secure containers on EKS and GKE, from image build through to runtime.
• Protect sensitive cloud data and lower the risk of exfiltration.
• Rank cloud vulnerabilities and misconfigurations by risk, push fixes with the owning teams, and support the Cyber Security & Assurance teams on cloud incidents.
• Add security checks to CI/CD pipelines, including infrastructure-as-code scanning, SAST, secret detection and image scanning. Maintain policy as code and review Terraform modules.
• Automate remediation, evidence collection and reporting using scripts and APIs.
• Build dashboards and KPIs on cloud posture, present them to governance forums, and advise engineering teams on implementing controls.

Requirements

• An undergraduate or postgraduate degree in computer science, engineering, information security or a related field, or equivalent experience.
• 5+ years of hands-on experience securing AWS and GCP workloads, with depth in one and working knowledge of the other.
• Hands-on use of at least one cloud-native application protection platform, such as Wiz, CrowdStrike Cloud Security, or Palo Alto Networks Prisma Cloud or Cortex Cloud.
• Strong knowledge of native AWS and GCP controls, including IAM, key management, organization-level policies, logging and network controls.
• Experience with Terraform and with securing CI/CD pipelines.
• Proficiency in Python or a similar language.
• Understanding of container and Kubernetes security, and of application security basics including the OWASP Top 10.
• Experience protecting sensitive data and reducing exfiltration risk.
• Fluent English is required.
• Advantage: AWS Certified Security Specialty, Google Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP, or vendor certifications from Wiz, CrowdStrike or Palo Alto Networks.
• Advantage: working knowledge of CIS Benchmarks, NIST and ISO 27001.
• Advantage: familiarity with commodity trading or financial services environments.
• Advantage: good knowledge of French.
• You work independently, spot gaps and propose improvements without being asked.
• You explain technical risk in business terms to engineers and non-technical stakeholders alike.
• You build trust with engineering teams and present security as something that enables delivery.
• You set priorities by risk and favour fixes that measurably reduce exposure.
• You make decisions and deliver at pace in a flat, high-ownership environment.
• You keep up with new cloud services and the threats that come with them.

Conditions

The company is committed to developing and sustaining a diverse workforce.

Benefits

• Work on demanding, high-stakes cloud workloads across 40+ offices and mission-critical trading systems.
• Hands-on use of leading cloud security platforms across AWS and GCP.
• Direct influence over how cloud security is designed and run, including standards and tooling.
• A non-hierarchical culture where ideas are judged on merit, decisions move quickly and bureaucracy is kept to a minimum.
• Work alongside technology and business colleagues across the global network, including Geneva, London, Houston and Singapore.