Principal Engineer, Cloud Security Engineering

Description

The team sits at the centre of a healthcare company and works on cloud security across a large, multinational, multi-cloud environment.

This is a senior technical authority role covering cloud security engineering, cloud-native protection, security automation, security posture management and secure platform integration.

The role aims to speed up secure cloud adoption, cut exposure that can be exploited, improve control effectiveness and modernise security engineering through automation and scalable platforms.

You will work with Cloud Platform Engineering, Enterprise Architecture, Cyber Defense, IAM, Application Security and technology teams to build security into cloud infrastructure and development lifecycles.

Responsibilities

• Design, build and implement enterprise cloud security capabilities across Azure, AWS and GCP (25% of the role).
• Create reusable security patterns for landing zones, subscriptions, accounts, projects, workloads and cloud services.
• Build controls for network segmentation, workload isolation, secure service connectivity and reducing internet exposure.
• Put security guardrails in place using native cloud controls and enterprise security platforms.
• Work with cloud platform teams to build security requirements into standard provisioning and deployment.
• Make sure cloud security designs support resilience, scale, operational efficiency and regulatory obligations.
• Build and tune CNAPP, CSPM, CWPP, CIEM and cloud exposure management tools (25% of the role).
• Connect cloud security platforms, cloud-native services, asset inventories and cyber defense tools.
• Maintain continuous visibility into misconfigurations, vulnerabilities, identity exposures and attack paths.
• Rank exploitable cloud security findings by risk.
• Build automated remediation workflows and preventive controls.
• Check platform coverage, data quality, control effectiveness and detection accuracy.
• Protect containers, Kubernetes, serverless services, virtual machines and managed cloud workloads.
• Write infrastructure-as-code and policy-as-code using Terraform, Bicep, CloudFormation, OPA or equivalent tools (20% of the role).
• Build preventive guardrails into cloud deployment pipelines.
• Automate security testing, drift detection, configuration validation and remediation.
• Add cloud security controls to GitHub Actions, Azure DevOps, GitLab or equivalent CI/CD systems.
• Create reusable modules, APIs and workflows that cut manual control work.
• Make cloud security engineering more reliable through automated testing, version control, observability and deployment standards.
• Use Microsoft Defender for Cloud, Azure Policy, AWS Security Hub, AWS Config, AWS Organizations, Google Security Command Center and related services (15% of the role).
• Build identity and privileged access integration patterns with IAM engineering teams.
• Support private connectivity, DNS security, ingress and egress protection and workload communication.
• Build cloud security telemetry pipelines for detection, investigation and incident response.
• Work with Application Security on workload and software supply chain security.
• Create integration patterns for M&A cloud environments, newly onboarded platforms and third-party cloud services.
• Act as principal technical advisor to Cloud Security leadership (15% of the role).
• Set cloud security engineering standards, reference patterns, technical roadmaps and reusable capabilities.
• Lead investigations into complex cloud security failures and systemic risks.
• Mentor engineers and shape cloud platform architecture decisions.
• Take part in design reviews and architecture governance.
• Work with global engineering and operations teams to set up sustainable production support.
• Drive improvements from control performance, incident lessons and new cloud threats.

Requirements

• Typically 10+ years in cybersecurity, cloud infrastructure, platform engineering, software engineering or a related field.
• Extensive hands-on work with Azure, AWS or GCP, with deep expertise in at least one of them.
• A track record of designing and building enterprise cloud security capabilities.
• Strong knowledge of cloud networking, identity, workload protection and cloud-native security services.
• Hands-on use of Terraform, Bicep, CloudFormation, Python, PowerShell or similar.
• Experience with CNAPP, CSPM, CWPP, CIEM or cloud exposure management.
• Solid understanding of CI/CD pipelines, DevSecOps and infrastructure automation.
• Experience with containers, Kubernetes, serverless or modern cloud-native workloads.
• Ability to troubleshoot complex cloud security issues across infrastructure, identity, networking and application boundaries.
• Proven record of delivering production-grade solutions and influencing cross-functional engineering teams.
• Preferred: deep Azure engineering experience, with practical AWS and GCP knowledge.
• Preferred: experience with Wiz, Microsoft Defender for Cloud, Prisma Cloud, Orca Security or comparable platforms.
• Preferred: experience with Azure Policy, AWS Organizations and SCPs, AWS Config, GCP Organization Policy and cloud-native guardrails.
• Preferred: knowledge of Azure Landing Zones, AWS Well-Architected Framework, AWS Control Tower and Google Cloud Architecture Framework.
• Preferred: experience with Kubernetes security, container image scanning, workload identity and cloud runtime protection.
• Preferred: experience with cloud security in regulated multinational environments.
• Preferred: understanding of NIST CSF, NIST SP 800-53, ISO 27001, HITRUST and relevant privacy or pharmaceutical regulations.
• Preferred: experience with M&A integration, cloud tenant onboarding and complex hybrid-cloud architectures.

Conditions

Full-time position.

The company is an equal opportunity employer.

Benefits

• Medical, dental and vision coverage, plus wellness support covering physical, emotional, financial and social health.
• Family support including backup dependent care, adoption assistance, infertility coverage, family building support, behavioral health solutions, paid parental leave and paid caregiver leave.
• Training programs, professional development resources, mentorship, employee resource groups and volunteer activities.