Note: The job is a remote job and is open to candidates in USA. VAILEXA is seeking a Senior Cloud Security Engineer to enhance their cloud security architecture. The role involves designing security baselines across multiple cloud platforms, conducting security posture assessments, and collaborating with teams to integrate security into the development lifecycle.
Responsibilities
- Design and enforce security baselines, guardrails, and policy-as-code across AWS, Azure, and GCP
- Conduct cloud security posture assessments; remediate misconfigurations identified by CSPM tools (e.g., Prisma Cloud, Wiz, Defender for Cloud, Security Command Center)
- Define and maintain secure landing-zone patterns, including account/project structure, network segmentation, and blast-radius reduction
- Collaborate with platform and application teams to ensure security requirements are addressed at the design phase
- Author and maintain reusable, security-hardened Terraform modules for provisioning cloud infrastructure
- Integrate IaC security scanning (e.g., Checkov, tfsec, Snyk IaC) into CI/CD pipelines to prevent drift and misconfigurations
- Manage secrets and dynamic credentials using HashiCorp Vault; define Vault policies, auth methods, and secret engine configurations
- Enforce infrastructure compliance via Sentinel policies or OPA/Conftest
- Shift security left by embedding SAST, DAST, dependency scanning, and container image scanning into build pipelines
- Build automated alerting and auto-remediation workflows for detected policy violations
- Partner with DevOps and platform engineering teams to standardize secure pipeline templates
- Promote security awareness through code review, architecture reviews, and internal enablement sessions
- Implement least-privilege IAM frameworks across all three cloud providers; audit and right-size existing roles and policies
- Configure and manage HashiCorp Vault for dynamic secrets, certificate management, and encryption-as-a-service
- Drive adoption of workload identity and federated authentication to eliminate long-lived credentials
Skills
- 5+ years writing production Terraform; deep familiarity with HCL, modules, workspaces, and remote state backends (S3, Azure Blob, GCS)
- Experience with Terraform Cloud / Terraform Enterprise, including policy enforcement via Sentinel
- Terraform testing frameworks: Terratest, native terraform test, or equivalent
- Drift detection, state management, and import workflows
- Deploy, configure, and operate HashiCorp Vault in highly available, production configurations
- Configure auth methods: AWS IAM, Azure, GCP, Kubernetes, AppRole, and OIDC/JWT
- Secret engines: KV v2, PKI, dynamic database/cloud credentials, SSH certificate signing, and Transit (encryption-as-a-service)
- Vault policies (HCL), namespaces, and replication (Performance and DR) in Enterprise environments
- Vault Agent and the Vault Secrets Operator for Kubernetes-native secret injection
- IAM: roles, policies, permission boundaries, Service Control Policies (SCPs), and AWS Organizations guardrails
- Security services: GuardDuty, Security Hub, AWS Config, CloudTrail, and AWS Firewall Manager
- Networking security: VPC design, security groups, NACLs, VPC endpoints, and AWS Network Firewall
- Encryption and secrets: KMS key policies, Secrets Manager, and ACM certificate lifecycle
- CSPM and compliance: AWS Security Hub standards (CIS, NIST, PCI-DSS), Config rules, and automated remediation via Lambda or Systems Manager
- Identity: Azure Active Directory (Entra ID), Conditional Access, Privileged Identity Management (PIM), and Managed Identities
- Security services: Microsoft Defender for Cloud, Sentinel SIEM, Azure Policy, and Blueprints
- Networking security: NSGs, Azure Firewall, Application Gateway WAF, DDoS Protection, and Private Endpoints
- Encryption and secrets: Azure Key Vault, disk encryption, and TLS/SSL certificate management
- Governance: Management Groups, Policy Initiatives, Azure Security Benchmark compliance, and RBAC role design
- IAM: resource hierarchy, organization policies, custom roles, and Workload Identity Federation
- Security services: Security Command Center, Cloud Armor, VPC Service Controls
- Networking security: Shared VPC, firewall rules, Cloud NAT, and hierarchical firewall policies
- Encryption and secrets: Cloud KMS, Secret Manager, Customer-Managed Encryption Keys (CMEK), and Certificate Authority Service
- CSPM: Security Health Analytics, Assured Workloads, and posture management via SCC findings
Company Overview
Company H1B Sponsorship