Staff Cloud Security Engineer

Role overview

Own security across a cloud-based platform, its infrastructure, applications, and corporate systems. As the first dedicated security engineer, you’ll set the security strategy and build the program hands-on, partnering with engineering leadership and serving as a technical point of contact for customers and auditors. The work spans cloud and application security, AI governance, compliance, incident response, and organizational security practices.

Responsibilities

- Design and harden AWS infrastructure, including identity, networking, encryption, logging, serverless services, databases, and Kubernetes; build security controls into infrastructure as code. - Secure APIs, applications, and real-time video capabilities through design reviews, threat modeling, testing, vulnerability management, and CI/CD safeguards. - Establish governance for internal and product AI use, including protections for sensitive information, model assets, and AI workflows. - Lead SOC 2 readiness and audits, maintain HIPAA security practices, automate evidence collection, and manage policies, risk records, vendors, and customer assessments. - Oversee endpoint and identity controls, security training, monitoring, incident response, and resilience planning. - Set the security roadmap, communicate risks and tradeoffs, mentor engineers, and make the case for security tools and future staffing.

Requirements

- At least 8 years in security engineering, including hands-on responsibility for production cloud environments and strong AWS security expertise. - Experience protecting PostgreSQL or other sensitive-data stores, and a strong background in application and API security. - Experience leading SOC 2 work and HIPAA compliance, ideally involving protected health information. - Familiarity with infrastructure as code and CI/CD security practices. - Experience with AI or LLM application security, including defenses against common LLM risks. - Incident response experience and the ability to explain security risks clearly to technical and nontechnical audiences.

Nice to have

- Experience with compliance automation, WebRTC or video security, or frameworks such as HITRUST, ISO 27001, and NIST. - Background building a security program in a startup or growth-stage organization; relevant security certifications; or experience handling sensitive data about children.

Benefits and work setup

- Remote-first role open to candidates anywhere in the United States. - Listed annual salary of $171,000–$199,500, equity options, medical, dental, and vision coverage, and generous paid time off.