Senior Engineer - Cloud Security Engineering

This is not a policy-only or advisory position. The role serves as remediation subject matter expert across the AWS environment, owning the full lifecycle of security findings from identifying code-level vulnerabilities to triaging and remediating Upwind CSPM findings across the cloud platform.

Responsibilities

Analyze code for security vulnerabilities (SAST/SCA output, dependency issues, insecure configurations, IaC misconfigurations) and work with development teams to remediate; Triage, prioritize, and drive remediation of Upwind CSPM findings across AWS accounts, workloads, and services; Own remediation runbooks and track findings through to closure, including root-cause fixes; Partner with engineering teams to remediate issues in Terraform/CloudFormation, container images, and application code; Act as the go-to SME for AWS security tooling and findings; Maintain and improve detection and remediation workflows, including automation (Lambda, EventBridge, SSM Automation); Track posture metrics and report on remediation velocity, aging findings, and risk trends; Assist in cloud security incident investigations, including log analysis, scoping impact, and supporting containment/remediation; Contribute to post-incident reviews and help translate findings into preventive controls; Participate in cloud security architecture reviews for new services and major changes; Provide practical, risk-based recommendations that balance security with delivery timelines

Requirements

3+ years of hands-on experience in cloud security with deep, practical AWS experience (IAM, VPC, KMS, S3, CloudTrail, Security Hub, GuardDuty, Config, Inspector); Direct experience remediating findings from a CSPM/CNAPP platform (Upwind, Wiz, Prisma Cloud, Orca, or similar); Experience analyzing and remediating application/code-level vulnerabilities (SAST, SCA, container image scanning); Working knowledge of Infrastructure as Code (Terraform and/or CloudFormation) and the ability to remediate misconfigurations directly in code; Scripting ability in Python and/or Bash for automation and investigation tasks; Familiarity with incident response processes and cloud-native log sources; Strong written and verbal communication skills; Fluent English

Nice to have

Experience securing containerized workloads (EKS, ECR, Kubernetes security policies); Exposure to CI/CD security integration (scanning gates, policy-as-code, pipeline hardening); Familiarity with compliance frameworks (SOC 2, ISO 27001, PCI-DSS, GDPR, NIST 800-53 Baseline Controls); AWS certifications (Security Specialty, Solutions Architect) or vendor CSPM certifications; Prior experience in a dedicated cloud security or DevSecOps team; Experience with ethical hacking; Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP), GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP)