Senior Cloud Security Engineer

Pantheon Data is seeking a Senior Cloud Security Engineer to own security architecture, controls, and continuous monitoring for AWS GovCloud environments hosting ML-enabled workloads and applications that process sensitive data. The role designs and verifies production security controls, leads threat response, and supports compliance and ATO activities.

Responsibilities:

• Identity and Access Management: Design and enforce least-privilege access across a multi-account AWS organization using IAM Identity Center, role-based access, permission boundaries, and service control policies; run periodic access reviews and eliminate long-lived credentials
• Security Guardrails: Define and maintain preventive and detective guardrails as code, including service control policies, AWS Config rules and conformance packs, and organization-wide CloudTrail, so new accounts and workloads are secure by default
• Threat Detection and Response: Operate and tune AWS security services (GuardDuty, Security Hub, Inspector, Macie, Detective) and integrate their findings and logs with the organization's SIEM; lead investigation and containment of cloud security incidents and maintain incident response runbooks
• Data Protection: Own the encryption and key management strategy (AWS KMS key policies, rotation, FIPS 140-validated endpoints) and the data perimeter controls protecting CUI, PII, and PHI across storage, databases, and Amazon Bedrock access paths
• Network Security: Define security group standards, network segmentation, AWS Network Firewall and WAF policies, and restricted-egress boundaries, and partner with Cloud Operations to implement them
• Vulnerability and Configuration Compliance: Run continuous vulnerability and configuration scanning across hosts, containers, and cloud resources against DISA STIGs and CIS benchmarks; prioritize findings and track remediation to closure with Cloud Operations and owning teams
• Compliance and ATO Support: Map technical controls to NIST SP 800-53; write and maintain control implementation statements; produce continuous monitoring evidence; track POA&M items to remediation; and support assessors during ATO and annual assessment activities
• Security Enablement: Review architectures and infrastructure-as-code changes for security, publish secure baseline patterns, and mentor engineers on cloud security practices

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Engineering, or a related technical field from an accredited university, or equivalent professional experience
• 7+ years of hands-on experience in security engineering, cloud engineering, or a closely related role, including 3+ years securing production AWS environments
• Deep, hands-on experience with AWS identity and access controls: IAM policy design and troubleshooting, cross-account roles, federated SSO or IAM Identity Center, and organization-level guardrails such as service control policies
• Experience operating cloud threat detection and security posture tooling, AWS-native or comparable, and turning findings into prioritized, tracked remediation
• Experience implementing encryption, key management, and network security controls in cloud environments
• Working understanding of security compliance frameworks and how they translate into technical controls, monitoring, and audit evidence
• Scripting proficiency in Python or Bash for security automation
• Current security certification such as CompTIA Security+, CISSP, or AWS Certified Security – Specialty
• Clear written communication, including documenting controls, findings, and remediation guidance for engineers and assessors
• Proficient in Microsoft Suite software including Outlook, Word, Excel, SharePoint, and PowerPoint
• Ability to work effectively remotely in cross-functional teams
• Ability to meet deadlines and produce quality work
• Candidates must have the ability to obtain and maintain a Secret clearance
• Terraform
• Direct experience supporting FedRAMP High or DoD IL4/IL5 ATO efforts: control implementation statements, SSP contributions, POA&M management, continuous monitoring, and assessor engagement
• Practical experience applying NIST SP 800-53, DoD RMF, and the DoD Cloud Computing SRG in AWS GovCloud, including DISA STIG and CIS benchmark compliance
• Certification that satisfies DoD 8140 requirements for privileged cybersecurity roles
• Experience with SIEM and log analytics platforms such as Splunk, Elastic/OpenSearch, or Amazon Security Lake, including building detections from CloudTrail, VPC Flow Logs, and application logs
• Container and Kubernetes security experience: Amazon EKS hardening, pod security standards, image scanning, and runtime protection
• Experience securing AI/ML workloads, including Amazon Bedrock access controls, data perimeter design for model inputs and outputs, and data exfiltration risks
• Policy-as-code experience with tools such as OPA, Cloud Custodian, or custom AWS Config rules
• Experience building automated security response, such as EventBridge- and Lambda-driven remediation
• an active Secret clearance