We're hiring a Senior Cloud Security Engineer to make our cloud environments secure by default. You'll design and build the guardrails, automation, and detection that keep our infrastructure defensible across multiple cloud providers.
You'll do it with a DevOps mindset: writing code, shipping changes through the same pipelines our engineers use, and building paved roads teams want to adopt, rather than handing down policy from the outside.
This role partners closely with platform and infrastructure engineering, customer support, and delivery teams, as well as IT and compliance.
What You'll DoOwn the security posture of our cloud environments across Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, applying consistent controls across providers.
Design secure reference architectures and reusable patterns — account and project structure, network segmentation, encryption and key management, secrets management — that teams can adopt instead of reinventing.
Build security into Infrastructure as Code (IaC) through hardened modules, policy as code, and pre-deploy checks, so misconfigurations are caught before they reach production.
Secure Continuous Integration / Continuous Delivery (CI/CD) pipelines and the software supply chain: pipeline permissions, secrets handling, artifact integrity, and short-lived workload identity in place of long-lived keys.
Design and enforce least-privilege Identity and Access Management (IAM) across clouds, including role design, federation with our identity provider, and periodic access reviews.
Write code and scripts to automate security controls, remediation, and evidence collection — if you do something twice, you automate it the third time.
Operate and tune Cloud Security Posture Management (CSPM) and cloud-native security services, and drive findings through to remediation with owning teams.
Build logging and detection for cloud control-plane and workload activity, and lead the cloud side of incident response.
Contribute security controls and evidence to our compliance posture (System and Organization Controls 2, or SOC 2, ISO 27001, etc.).
A DevOps foundation — you've worked in a DevOps, Site Reliability Engineering (SRE), or platform engineering role, and you've built and operated production infrastructure and CI/CD pipelines yourself, not just reviewed them.
Hands-on production experience securing at least two major cloud providers (AWS, GCP, or Azure), and a clear understanding of how their identity, networking, and logging models differ.
Deep knowledge of cloud security best practices — for example, the Center for Internet Security (CIS) Benchmarks and each provider's security foundations guidance — and the judgment to apply them pragmatically rather than as a checklist.
Fluency in proven cloud security patterns: least-privilege IAM and workload identity, network segmentation and private connectivity, encryption and key management, secrets management, centralized logging, and preventive guardrails (for example, AWS Service Control Policies or GCP Organization Policies).
Strong coding and scripting skills in at least one general-purpose language (for example, Python or Go) plus shell scripting; you write automation other engineers can read and maintain.
Hands-on experience with IaC (for example, Terraform or OpenTofu) and with embedding security checks into it.
Strong communication skills — you work directly with engineers and can explain risk in terms they'll act on.
Familiarity with open-source cloud security tooling (for example, Prowler for posture assessment, Checkov or Trivy for IaC and container scanning, Open Policy Agent (OPA) for policy as code, Falco for runtime detection).
Container and Kubernetes security experience (Amazon EKS, Google Kubernetes Engine, or Azure Kubernetes Service), including admission control and runtime policy.
A relevant cloud security certification (for example, AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, Microsoft Azure Security Engineer Associate, or Certified Cloud Security Professional, CCSP).
Experience securing SaaS and developer platforms, such as identity providers and GitHub organizations.
Experience supporting a SOC 2, ISO 27001, or similar program, including compliance automation platforms.
Hands-on cloud incident response or forensics experience.
You've mapped our cloud footprint across providers — accounts and projects, identities, internet exposure, and sensitive data stores — and identified the highest-priority risks with a remediation plan.
Baseline guardrails, centralized logging, and posture monitoring cover every cloud account and project, with findings routed to the teams that own them.
Security checks run automatically on infrastructure changes in CI/CD, and engineers know how to engage you early on new infrastructure work.
Remote in North America
Skills Required
- Experience in a DevOps, Site Reliability Engineering, or platform engineering role, including building and operating production infrastructure and CI/CD pipelines
- Hands-on production experience securing at least two major cloud providers: AWS, GCP, or Azure
- Knowledge of cloud security best practices, including CIS Benchmarks and cloud provider security foundations guidance
- Experience with least-privilege IAM, workload identity, network segmentation, private connectivity, encryption, key management, secrets management, centralized logging, and preventive guardrails
- Strong coding and scripting skills in at least one general-purpose language such as Python or Go, plus shell scripting
- Hands-on experience with Infrastructure as Code, such as Terraform or OpenTofu, including embedding security checks
- Strong communication skills and ability to explain security risks to engineering teams
- Familiarity with cloud security tools such as Prowler, Checkov, Trivy, Open Policy Agent, or Falco
- Container and Kubernetes security experience, including admission control and runtime policy
- Relevant cloud security certification, such as AWS Certified Security Specialty, Google Professional Cloud Security Engineer, Microsoft Azure Security Engineer Associate, or CCSP
- Experience securing SaaS and developer platforms, including identity providers and GitHub organizations
- Experience supporting SOC 2, ISO 27001, or similar compliance programs, including compliance automation platforms
- Hands-on cloud incident response or forensics experience
What We Do
Enterprise transformations shouldn't take years or cost fortunes. At Tessera, we've built a multi-agent AI platform that cuts ERP transformation timelines from years to weeks and reduces costs by more than half—while delivering first-time-right outcomes with enterprise-grade security and governance. We combine the dependability of a trusted integrator with the speed of an AI innovator. Our vendor-agnostic platform is pre-trained on thousands of enterprise landscapes and hundreds of years of expertise, so it adapts to your environment from day one—harmonizing systems and data to deliver secure, governed execution across ERP and other critical systems. Unlike traditional system integrators, ERP vendor tools, AI point solutions, or in-house builds, Tessera delivers transformations that compress timelines by 90%, replace people-heavy manual work with intelligent automation, ensure systems and data harmonize correctly from the start, and avoid vendor lock-in through adaptive intelligence that evolves with your workflows. Tessera creates lasting change in how your processes and systems operate together. As the platform adapts to your environment and evolves with new data, you gain the confidence to modernize with less risk—freeing up resources to reinvest in growth rather than maintaining legacy complexity. Proven in regulated industries. Built for enterprise reality. Reshaping how organizations transform.
