Senior Cloud Security Engineer

Description

The company builds an AI agent platform that personalizes the whole customer journey for businesses.

It is bringing autonomous search to the mainstream, making product discovery more conversational and more profitable for businesses.

Shopping help is available on demand at every touchpoint, and marketing workflows are being automated so marketers can focus on creative, strategic, and customer-first work.

All of this runs on one shared AI engine, so personalization is both autonomous and consistent.

The platform serves more than 1,400 global brands across retail, financial services, hospitality, and gaming, including American Eagle, Sonepar, and Pandora.

You will be a trusted security partner to Engineering, DevOps, and IT. You will harden AWS environments, containerized and Linux workloads, and corporate infrastructure and identity tooling, while working with the SOC team, which owns detection, alerting, playbooks, and incident triage.

You will be a key member of the Cloud Security team, owning cloud and corporate security architecture, vulnerability remediation, and Splunk administration and data integration. The list of duties below is not limited to these items.

In your first 30 days, learn the AWS environment, corporate infrastructure, and existing controls, including JumpCloud and Twingate setups. Learn the team's tooling, current Splunk integrations, and how the team works with the SOC on detection coverage. Review CVE processes, IaC pipelines, and baselines for cloud, container, and Linux. Build relationships with Engineering, DevOps, IT, and the SOC, and spot quick wins for hardening, IaC guardrails, or corporate configurations.

In the first 60 days, triage and drive fixes for infrastructure, container, and web vulnerabilities on your own. Add at least one new data source to Splunk and help maintain existing pipelines. Contribute to IaC scanning and policy-as-code in CI/CD. Work with Engineering and IT to close CVE and patching gaps while tracking MTTR and remediation rates. Begin mentoring junior team members on cloud and infrastructure security basics.

In the first 90 days, lead an end-to-end security architecture review of at least one major AWS workload or corporate system, finding risks and driving mitigations. Take hands-on ownership of Linux, container, and Kubernetes hardening for at least one environment. Propose improvements to architecture standards or automation based on gaps you observe. Manage CVE lifecycle work consistently with little supervision. Mentor junior engineers and help set the team's security roadmap priorities.

The company values freedom and trust. There are no clock-in rules, few corporate policies, and short approval chains, and results count from day one. Working hours are flexible. Teams work virtual-first, with hubs on three continents. The company defines five values and ten key behaviors, which shape hiring, onboarding, feedback, development, and reviews. The company also holds events for the global team.

Responsibilities

• Design, implement, and monitor AWS security controls using native services such as IAM, GuardDuty, Security Hub, KMS, VPC and security groups, and Config to protect production.
• Keep up to date on the AWS security service landscape, evaluate new and existing services, and close coverage gaps.
• Harden Linux servers and secure Docker and Kubernetes workloads, covering hosts, images, runtime, and cluster and workload configuration.
• Secure corporate infrastructure, including administering JumpCloud for identity and access and Twingate for zero-trust network access.
• Run Splunk as a data platform by onboarding log sources, maintaining pipelines, and keeping the platform healthy and licensed, working with the SOC.
• Find, triage, and drive fixes for infrastructure and web application vulnerabilities with engineering teams, aiming to reduce MTTR and raise remediation rates.
• Lead CVE lifecycle work and patching, perform root cause analysis, and track metrics across cloud, corporate, and on-prem systems.
• Build secure automation for remediation and hardening in Python, Go, Bash, or similar languages.
• Add security guardrails and policy-as-code to IaC and CI/CD pipelines, scan IaC statically, and enforce baselines before deployment.
• Define logging and telemetry needs for cloud, container, and corporate assets so the SOC has the coverage it needs.
• Write, document, and roll out security architecture standards with engineering pillars and IT.
• Act as the technical subject-matter expert for cloud, container, and corporate infrastructure during SOC incident response.
• Mentor junior security engineers and set priorities by risk and business impact.

Requirements

• 6+ years of hands-on cybersecurity engineering, focused on cloud security, infrastructure security, and system hardening.
• Deep hands-on experience with AWS security, including secure architecture, IAM, and native services such as GuardDuty, Security Hub, KMS, Config, and Inspector.
• Strong Linux administration and hardening skills, plus hands-on experience securing Docker and Kubernetes.
• Experience securing corporate infrastructure and identity tools such as JumpCloud, Twingate, or comparable zero-trust or IAM platforms.
• Experience administering Splunk or a comparable SIEM as a log and data pipeline, including onboarding sources and maintaining platform health.
• Proven ownership of the vulnerability and CVE lifecycle, including triage, root cause analysis, patching, and MTTR and remediation-rate reporting.
• Scripting skills in Python, Go, or Bash to build or extend security tooling.
• Experience with policy-as-code and guardrails in CI/CD pipelines, including static IaC scanning and pre-deployment baselines.
• Working knowledge of CIS and NIST frameworks and of typical weaknesses in infrastructure, containers, and web applications.
• Strong communication across teams, with experience working closely with SOC, engineering, and IT on shared security outcomes.
• Experience mentoring engineers and prioritizing security work by risk and business impact.
• Preferred certifications: AWS Certified Security, Specialty, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP, or CCSK.

Conditions

Base salary range is €38.095 to €47.619 EUR.

The pay actually offered may differ from this range and depends on factors such as skills, qualifications, geographic location, accomplishments, experience, credentials, internal equity, and business needs.

Restricted Stock Units or Stock Options are granted based on role, seniority, and location.

Everyone takes part in the company performance bonus.

This is a remote role.

Benefits depend on employment type. Interns are usually exempt from some benefits for the first 6 months.

Benefits

• Up to 5 paid days off for volunteering.
• A $1,500 professional education budget each year for books, courses, certifications, and similar items.
• A People Development Program with workshops run by internal experts, and competency maps for select functions.
• Access to an in-house communication coach for work-related communication and decision-making.
• Managers are encouraged to join a Leader Development Program with comprehensive feedback, coaching, and follow-up check-ins.
• An Employee Assistance Program with counselors for non-work challenges.
• A subscription to Calm, a sleep and meditation app.
• One extra day off each quarter for DisConnect days, taken together across the company.
• Sports, yoga, and meditation opportunities.
• Up to 26 calendar weeks of extended parental leave for primary caregivers.
• Work anniversaries are celebrated.