Note: The job is a remote job and is open to candidates in USA. LeoLabs is a company focused on building a living map of activity in space through a global radar network and AI-enabled analytics. They are seeking a Cloud Engineer to design and operate secure, scalable cloud landing zones as part of their architecture modernization initiative, supporting both commercial and government cloud environments.
Responsibilities
- Design, build, and maintain secure cloud landing zones across AWS and Azure environments
- Implement account and subscription structures that separate workload zones, including commercial workloads, government workloads, Corporate IT, security services, and restricted CUI/ITAR environments
- Build baseline controls for new cloud accounts and subscriptions, including owner tagging, logging, security baselines, routing, encryption, key policies, break-glass review, and monitoring requirements
- Support landing-zone acceptance criteria so new cloud environments are provisioned with required guardrails before workloads are deployed
- Implement federated access patterns using SAML/OIDC, IAM Identity Center, Azure Entra ID, or comparable identity platforms
- Support least-privilege access, role lifecycle management, JIT/PIM/PAM workflows, service account controls, and removal of shared accounts
- Help automate credential rotation, secrets management, service account governance, and break-glass monitoring
- Partner with the Security team to ensure privileged cloud activity is authenticated, authorized, logged, reviewed, and tied to approved workflows
- Implement preventative and detective cloud guardrails using tools such as AWS Organizations, SCPs, AWS Config, Azure Policy, Defender for Cloud, Wiz, Terraform, CloudFormation, Bicep, or similar platforms
- Codify baseline configurations for logging, encryption, network controls, public exposure prevention, security-group rules, storage policies, KMS/key vault use, and workload tagging
- Monitor and remediate drift from approved cloud security baselines
- Support detection and automated response for public admin exposure, cloud policy drift, unapproved data movement, stale credentials, and overly permissive IAM roles
- Partner with the Network team to implement secure cloud network patterns, including hub-and-spoke networking, transit gateways, vWAN, private endpoints, centralized DNS, private admin paths, and controlled egress
- Ensure cloud workloads are not exposed through unnecessary public interfaces
- Support routing and connectivity decisions for radar telemetry and other cloud workload environments
- Implement cloud-side controls for SASE/ZTNA access, private application access, firewall inspection, flow logging, and route governance
- Integrate cloud logs and security signals into centralized SIEM/SOC workflows
- Onboard and maintain telemetry sources such as CloudTrail, AWS Config, VPC Flow Logs, Azure Activity Logs, NSG Flow Logs, Entra ID logs, KMS/Key Vault events, storage access logs, CSPM findings, vulnerability findings, and workload security events
- Partner with the Security team to build detection use cases for exposed cloud services, privileged access anomalies, credential hygiene drift, data boundary violations, and cloud configuration drift
- Support retention tiers, immutable logging, audit trails, alert evidence, and compliance reporting requirements
- Help automate evidence collection customer and governmental regulatory frameworks
- Create reusable artifacts such as policy exports, IaC repositories, drift reports, access reviews, logging configurations, encryption evidence, SIEM cases, and change records
- Support compliance control areas including access control, identification and authentication, audit and accountability, system and communications protection, configuration management, system integrity, and incident response
- Ensure that compliance evidence is generated from the same systems that enforce security controls, reducing manual artifact collection
- Create clear documentation for landing-zone patterns, account vending, guardrails, IAM roles, logging flows, network integration, operational runbooks, and escalation paths
- Participate in architecture decision records, change control, incident response, and modernization planning
- Work with Security, Network, SRE, IT Support, and other Engineering teams to ensure cloud capabilities are operationally supportable
- Help define and execute the cloud modernization backlog across containment, capability buildout, and full modernization phases
Skills
- Must be eligible to obtain and maintain a U.S. personnel security clearance
- 5+ years of hands-on cloud engineering experience in AWS, Azure, or hybrid cloud environments
- Strong experience with AWS and/or Azure core services, including IAM, networking, logging, encryption, storage, compute, security monitoring, and account/subscription management
- Experience building or operating cloud landing zones, multi-account AWS environments, Azure management groups, or similar cloud governance structures
- Hands-on experience with infrastructure-as-code tools such as Terraform, CloudFormation, Bicep, CDK, Ansible, or similar
- Experience implementing cloud security controls, including IAM least privilege, logging baselines, encryption, key management, public exposure prevention, security groups, policy enforcement, and configuration monitoring
- Experience integrating cloud logs or findings into SIEM, SOAR, CSPM, or monitoring platforms
- Working knowledge of cloud networking, including VPC/VNet design, routing, private endpoints, security groups, NACLs/NSGs, flow logs, transit gateways, vWAN, VPNs, and egress controls
- Ability to document cloud designs, implementation plans, runbooks, and compliance evidence
- Strong collaboration skills with security, networking, infrastructure, SRE, and operations teams
- Experience with AWS GovCloud, Azure Government, or other regulated cloud environments
- Experience supporting CUI, ITAR, NIST 800-171, CMMC 2.0 ML2, FedRAMP, or government/customer compliance requirements
- Experience with Microsoft Sentinel, Wiz, Dropzone AI, Defender for Cloud, Security Hub, GuardDuty, Inspector, Macie, or similar platforms
- Experience with SSO, SCIM lifecycle, MFA/FIDO2, PAM/PIM, JIT access, service account vaulting, and automated credential rotation
- Experience building policy-as-code or compliance-as-code frameworks
- Experience creating automated evidence artifacts from cloud control planes, SIEM platforms, CSPM tools, ticketing systems, and IaC pipelines
- Experience with secure data-boundary design, including CUI/ITAR enclaves, KMS/key policies, DLP, retention, immutable logs, and restricted access patterns
- Experience supporting cloud incident response, containment automation, or SOAR playbooks
Benefits
- Global workforce: flexible remote/hybrid opportunities
- Work on complex, meaningful missions with real-world impact
- Unlimited paid time off for most roles
- Competitive salary and equity packages
- Comprehensive health, dental, and vision coverage
- Access to the forefront of commercial space operations and defense innovation
Company Overview