Senior Cloud Security Engineer

Beyond Finance helps everyday Americans escape debt through individualized care, compliance-focused practices, supportive technology, and customized financial solutions. The Senior Cloud Security Engineer will harden the company’s AWS environment and software development pipeline, with a primary focus on cloud security and vulnerability management using Wiz. The role partners with DevOps, Engineering, and Application Security to build preventative controls, secure infrastructure and CI/CD pipelines, automate security workflows, and operate web application firewall protections.

Responsibilities:

• Own cloud security posture across our AWS environment using Wiz and AWS-native services, reducing risk across IAM, network segmentation, container security, secrets, and data exposure
• Establish secure defaults in our Infrastructure as Code through reusable modules, guardrails, and policy as code
• Harden CI/CD pipelines in partnership with DevOps
• Run vulnerability management across cloud and application findings: intake, prioritization, SLA tracking, and remediation with engineering
• Build automation that scales the program: ingestion, deduplication, prioritization, and developer-facing workflows
• Instrument telemetry, alerting, and runbooks for the systems you own
• Operate and tune our WAF: managed and custom rules, rate limiting, and bot mitigation

Requirements:

• 5+ years of hands-on security engineering across cloud security and vulnerability management
• Strong AWS security background: IAM, networking, container orchestration, and logging and audit
• Hands-on experience securing CI/CD pipelines and Infrastructure as Code; Terraform required
• Experience running or substantially contributing to a vulnerability management program
• Working knowledge of OWASP Top 10 and threat modeling
• Operates independently and drives projects without day-to-day oversight
• Experience with our stack: Wiz, Cloudflare (WAF, Gateway, Zero Trust), GitHub Advanced Security, Spacelift, and AWS-native services
• Hands-on WAF experience in production: writing and tuning rules, managing false positives, responding when something gets through
• AI/ML security exposure: prompt injection, data poisoning, model abuse, and the controls that mitigate them
• Secrets management platforms (AWS Secrets Manager, Keeper, Infisical)
• Identity security across human and non-human identities
• PCI-regulated or financial services environment
• Familiarity with Ruby on Rails, Python, or Go