Senior Cloud Security Engineer

Description

The company builds an AI-driven personalization platform that helps businesses engage customers across their whole journey, from autonomous search and conversational shopping to marketing workflows.

The platform serves more than 1,400 global brands in retail, financial services, hospitality and gaming.

The Cloud Security team is a small partner to Engineering, DevOps and IT, working closely with the SOC team, which owns detection content, alerting, playbooks and incident triage.

First 30 days: learn the AWS environment, corporate infrastructure and current controls, including JumpCloud and Twingate setups; learn the team's tooling and Splunk integrations; review CVE processes, IaC pipelines and baselines; build relationships with Engineering, DevOps, IT and the SOC; spot quick wins for hardening, IaC guardrails and corporate configuration.

First 60 days: independently triage and drive remediation of infrastructure, container and web vulnerabilities; onboard at least one new Splunk data source and help maintain pipelines; contribute to IaC scanning and policy-as-code in CI/CD; close CVE and patching gaps with Engineering and IT while tracking MTTR and remediation rate; begin mentoring junior team members.

First 90 days: own an end-to-end security architecture review for at least one major AWS workload or corporate system; show hands-on ownership of Linux, container and Kubernetes hardening in one environment; propose improvements to standards or automation; run the CVE lifecycle with minimal supervision; mentor junior engineers and help shape the team's security roadmap.

Responsibilities

• Design, implement and monitor security controls across AWS production environments using native services such as IAM, GuardDuty, Security Hub, KMS, VPC security groups and Config.
• Keep up with the AWS security service landscape, assessing new and existing services to close coverage gaps.
• Harden Linux servers and secure containerized workloads on Docker and Kubernetes, covering host hardening, image and runtime security, and cluster and workload configuration.
• Secure corporate infrastructure, including administration of identity and access tools such as JumpCloud and zero-trust network access such as Twingate.
• Administer and integrate Splunk as a data platform: onboard log sources, maintain pipelines, and support platform health and licensing, working with the SOC team on detection.
• Identify, triage and drive remediation of infrastructure and web application vulnerabilities with engineering teams, aiming to cut MTTR and raise remediation rates.
• Lead CVE lifecycle management and patching, run root cause analysis, and track remediation metrics across cloud, corporate and on-prem systems.
• Build and maintain secure automation for remediation and hardening in Python, Go, Bash or similar languages.
• Add security guardrails and policy-as-code to Infrastructure as Code and CI/CD pipelines, including static IaC scanning and security baselines before deployment.
• Define logging and telemetry requirements for cloud, container and corporate assets so the SOC has the data it needs.
• Write, document and roll out security architecture standards for cloud, container and corporate infrastructure with engineering and IT.
• Act as the technical subject-matter expert for cloud, container and corporate infrastructure during incident response with the SOC.
• Mentor junior security engineers and set priorities by risk and business impact.

Requirements

• At least 6 years of hands-on cybersecurity engineering experience, focused on cloud security, infrastructure security and system hardening.
• Deep hands-on experience securing AWS, including secure architecture, IAM, and native services such as GuardDuty, Security Hub, KMS, Config and Inspector.
• Strong knowledge of Linux administration and hardening, plus hands-on work securing Docker and Kubernetes.
• Experience securing corporate infrastructure and identity or access tools such as JumpCloud, Twingate, or comparable zero-trust or IAM platforms.
• Experience running Splunk or a comparable SIEM or data platform, including onboarding sources and keeping the platform healthy.
• Proven ownership of the vulnerability and CVE lifecycle, including triage, root cause analysis, patching and MTTR or remediation-rate reporting.
• Scripting skills in Python, Go or Bash to build and extend hardening and remediation tools.
• Experience putting policy-as-code and guardrails into CI/CD, including static IaC scanning and pre-deployment baselines.
• Working knowledge of frameworks such as CIS and NIST, and of common weaknesses in infrastructure, containers and web applications.
• Strong cross-functional communication, with experience working with SOC, engineering and IT on shared security goals.
• Experience mentoring junior engineers and prioritizing work by risk and business impact.
• Preferred: AWS Certified Security, Specialty, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP or CCSK.

Conditions

Remote role, with the team working virtual-first and several hubs across three continents.

Flexible working hours, with no clock-in or clock-out.

Base salary range is 858,667 CZK to 1,073,333 CZK; the final offer may differ based on skills, qualifications, location, experience, credentials, internal equity and business needs.

Restricted Stock Units or Stock Options are granted based on role, seniority and location.

Everyone takes part in the company performance bonus.

The company gives equal consideration to all applicants, regardless of background.

Benefits

• A people development program with internal workshops, competency maps for selected functions, and an in-house communication coach.
• Leaders can join a Leader Development Program with feedback, coaching and follow-up check-ins.
• An annual $1,500 professional education budget for books, courses and certifications.
• An Employee Assistance Program with counselors for personal challenges outside work.
• A subscription to a sleep and meditation app.
• One extra day off each quarter for a company-wide DisConnect day.
• Sports, yoga and meditation activities.
• Up to 26 calendar weeks of extended parental leave for primary caregivers.
• Five paid days off each year for volunteering.
• Work anniversary recognition.
• Company events that bring the global team together.
• Interns are exempt from some benefits, usually for their first 6 months.