Staff Security Engineer

Snyk is a leader in secure AI software development, providing an AI-native Developer Security Platform that integrates into development and security workflows. The Staff Security Engineer role focuses on owning cloud and identity security for Snyk's multi-cloud estate, emphasizing a threat-driven approach to cloud security posture, identity management, and AI-driven automation. The position involves securing cloud infrastructure, building preventative controls, and collaborating across teams to enhance security measures.

Responsibilities:

• Owning cloud security posture across AWS and GCP - Driving coverage and signal quality, prioritising by exploitability rather than raw severity counts, holding remediation accountability with the teams that own the resources, and reporting posture as a trend over time
• Leading cloud IAM and least privilege. Designing and enforcing permission models across accounts and projects: organization level policy and guardrails, permission boundaries, cross-account role design, workload identity federation, and the full lifecycle of non-human identities, keys, and secrets
• Owning the security posture of our enterprise identity platform. Authentication and authorization policy, phishing resistant MFA, privileged access, joiner mover leaver enforcement, and the identity signals that reveal account compromise or insider risk
• Hunting and eliminating cloud attack paths. Reasoning about chained privilege escalation, lateral movement between accounts and workloads, and data exposure, then removing the conditions that make those chains possible
• Building preventative guardrails. Pushing controls into infrastructure as code modules, admission control, CI checks, and organization policy so that misconfigurations fail before deployment rather than getting caught afterwards
• Building AI and agentic automation for security work. Using LLMs and agents to automate posture remediation, access reviews, cloud evidence gathering, and investigation enrichment. Turning repeatable expert judgment into tooling the whole team can run
• Securing Snyk's AI adoption. Establishing the controls for internal AI and agent use: permissions and blast radius for autonomous agents, tool and MCP server trust, third party AI risk review, and the identity and data boundaries AI systems operate within
• Securing the cloud infrastructure behind Snyk's AI capabilities. IAM, network segmentation, and data controls for the accounts, model workloads, and pipelines that power our AI features
• Strengthening cloud detection and response. Making sure cloud control plane and workload telemetry produces detections that fire on real attacker behaviour, and acting as the cloud subject matter expert during incidents
• Defending the edge. WAF and DDoS posture, plus cloud deception coverage that catches an intruder early
• Partnering across teams. Working with Platform and Infrastructure Engineering, Product Security, and Compliance to land controls through influence rather than mandate. This includes supporting the cloud controls in our public sector environment, which is a smaller part of the role
• Raising the team's cloud ceiling. Mentoring engineers, acting as an escalation point for complex cloud investigations, and taking part in the EntSec on-call rotation

Requirements:

• 8+ years in security engineering, including at least 4 focused specifically on securing cloud environments at production scale
• Expert level AWS security and strong working knowledge of GCP. You can reason about IAM policy evaluation, organization level guardrails, network and VPC design, key management and encryption, and logging architecture without reaching for the documentation
• Deep, hands-on cloud IAM expertise. Designing least privilege models across multi-account and multi-project estates, right-sizing over-permissioned roles without breaking production, and managing non-human identities, workload identity federation, and secrets at scale
• An attacker's understanding of cloud. You know how cloud environments actually get compromised (credential and token abuse, IAM privilege escalation chains, metadata and workload identity abuse, exposed storage and services, CI/CD and supply chain paths) and you design controls against those paths rather than against a checklist
• Real ownership of an enterprise CSPM or CNAPP platform. Onboarding accounts, tuning signal to noise, building remediation workflows, and holding the line on posture metrics over time
• Infrastructure as code and genuine coding ability. Terraform, Python or Go
• Kubernetes security in the cloud. RBAC, service accounts and token handling, admission control, workload identity, network policy, and container runtime posture
• Practical experience applying AI to engineering work. You have built something real with LLM APIs or agent frameworks, and you understand AI specific risk (prompt injection, over-permissioned agents and tools, untrusted tool and MCP servers, data leakage) well enough to design controls for it
• Enterprise identity platform security. Hands-on with a major IdP: policy design, federation, phishing resistant authentication, privileged access, and access review
• Cloud detection fundamentals. Cloud provider audit logs and native threat detection services, what good cloud detection logic looks like, and how cloud telemetry lands and gets queried in a SIEM
• Strong written communication and stakeholder influence
• Bachelor's degree in computer science, information security, or information technology, or equivalent practical experience
• Have worked in the DevSecOps, cloud security, or AI industry, or have defended a security product company
• Have built agentic security tooling, MCP servers, or internal AI platforms, and have well formed opinions about where they should and should not be trusted
• Have done cloud incident response or cloud threat hunting on a real intrusion
• Have contributed to open source cloud security tooling, or published research on cloud attack techniques
• Have led a cloud migration or a multi-cloud consolidation and lived with the security consequences
• Have worked in a FedRAMP, NIST 800-53, or similar regulated cloud environment
• Hold relevant security certifications. None are required, but they are welcomed. Examples include: CISSP (Certified Information Systems Security Professional), CCSP (Certified Cloud Security Professional), SANS / GIAC: GPCS (Public Cloud Security), GCLD (Cloud Security Essentials), GCSA (Cloud Security Automation), GCFR (Cloud Forensics Responder), GDSA (Defensible Security Architecture), GCPN (Cloud Penetration Tester), AWS Certified Security Specialty, Google Professional Cloud Security Engineer