Senior Engineer, Cloud Security

Workstreet is seeking a Senior Engineer, Cloud Security to design and deploy secure cloud infrastructure, with an emphasis on Azure and multi-cloud architectures. The role builds hardened environments and reusable Infrastructure as Code, remediates vulnerabilities, automates security operations, and leads technical work directly with clients.

Responsibilities:

• Engineer security via Infrastructure as Code - design and maintain reusable Terraform and CloudFormation modules for IAM, networking, and logging to build drift-resistant cloud environments
• Build enterprise cloud architectures - deploy and manage AWS multi-account structures including Organizations and SCPs, alongside Azure Hub-Spoke and Landing Zone architectures
• Architect identity and access management - implement least-privilege IAM using RBAC, ABAC, permission boundaries, JIT or PIM automation, and federated identity via Okta or Entra ID
• Execute direct vulnerability remediation - remediate cloud misconfigurations through active engineering changes, automated patching, and configuration drift correction
• Automate security operations and pipelines - build automated remediation workflows using Lambda, Azure Functions, and Python, integrating SAST, DAST, and secret scanning into GitHub Actions or Azure DevOps pipelines
• Configure native cloud security stacks - deploy and tune AWS GuardDuty, Security Hub, AWS Config, Microsoft Sentinel, and Defender for Cloud to build native logging pipelines for SIEM ingestion
• Manage network and encryption engineering - design VPCs, security groups, network segmentation, WAFs, and full-lifecycle encryption using AWS KMS and Azure Key Vault
• Implement technical NIST 800-53 controls - translate NIST 800-53, FedRAMP, and CMMC compliance criteria into hands-on technical controls across cloud environments
• Drive client-facing technical ownership - interface directly with client engineering teams, lead architectural workshops, and manage multiple client engagements simultaneously

Requirements:

• proven track record of deploying security infrastructure, writing OPA policies, and managing secrets in Vault or AWS Secrets Manager
• deep expertise in Azure and AWS nuances, capable of distinguishing compliance maps from functional technical controls
• proficient in Terraform, with demonstrated expertise in module versioning, state management, and provider security controls
• deep technical understanding of SAML, OIDC, cross-account IAM roles, and enforcing least privilege without disrupting developer workflows
• with a strong verbal presence, able to lead technical workshops and clearly explain complex architecture to engineering teams
• Excellent written and verbal English communication skills
• Applicants must be authorized to work in the U.S. without the need for visa sponsorship now or in the future
• technical certifications such as AWS Certified Security Specialty, Azure Security Engineer Associate, or GCP Professional Security Engineer
• practical experience configuring and enforcing FIPS 140 standards across cloud services
• hands-on history building CMMC-compliant enclaves or FedRAMP security architectures
• experience implementing runtime security controls and vulnerability scanning across containerized environments