Principal Cloud Security Engineer
HealthEquity, Inc.2 days ago
Remote, United StatesStaff+
Base Salary
$159k - $211k/yr
Responsibilities
- Lead cloud security posture management across a large multi-account and multi-subscription estate using CNAPP/CSPM tooling.
- Design and build policy-as-code guardrails, service control policies, Azure Policy controls, and infrastructure-as-code validation in CI/CD pipelines.
- Own security architecture for cloud landing zones, account and subscription provisioning, security baselines, guardrails, and logging.
- Build event-driven automated remediation and detection controls enforcing security and compliance baselines at scale.
- Reduce network exposure through WAF management, tighter security-group and network-security-group ingress, and private connectivity.
- Define and evolve IAM strategy across Azure, AWS, and GCP, including federated identity, SSO, least privilege, and conditional access.
- Lead threat modeling and architecture reviews, coordinate penetration tests and audits, and drive prioritized remediation.
- Partner with Application Security and Vulnerability Management on code scanning, secret detection, dependency analysis, and software supply chain controls.
- Establish security governance for AI services and AI-enabled development tooling, including model guardrails and MCP security.
- Set technical direction, identify systemic risks, improve tools and standards, and mentor security engineers.
Requirements
- 12+ years of experience in cloud security, security engineering, application security, or a closely related discipline.
- Deep hands-on experience securing production AWS and Azure environments at enterprise scale, including multi-account and multi-subscription estates.
- Advanced experience with CNAPP/CSPM, policy-as-code, preventive guardrails, AWS Config, CloudFormation Guard, Azure Policy, CloudFormation, and CDK.
- Strong knowledge of AWS and Azure security services, cloud network security, WAFs, API gateways, and private connectivity patterns.
- Proficiency in Python, PowerShell, and Bash for security automation and tooling.
- Advanced knowledge of federated identity, SSO, SAML, OAuth 2.0, OIDC, least privilege, and conditional access.
- Strong application security foundation including threat modeling, architectural security reviews, secure code review, OWASP Top 10, and CWE Top 25.
- Experience building vulnerability management and software supply chain programs involving SAST, secret scanning, and software composition analysis.
- Working knowledge of AI and LLM security risks, model guardrails, MCP, and AI-assisted development controls.
- Hands-on understanding of penetration testing and offensive-security findings.
- Experience leading initiatives across cross-functional teams, mentoring engineers, and communicating complex risks to technical and non-technical stakeholders.
- Preferred: experience with CI/CD security capabilities, bug bounty or vulnerability disclosure programs, regulated industries, HIPAA, SOC 2, NIST Cybersecurity Framework, or relevant security certifications such as AWS Certified Security Specialty, Microsoft Azure security certifications, CCSP, or CISSP.
Benefits
- Remote position.
- Base salary range of $159,000 to $210,500 per year, plus performance-based incentives and restricted stock units.
- Medical, dental, vision, HSA contribution and match, and dependent-care FSA match.
- Uncapped paid time off and paid parental leave.
- 401(k) match, financial literacy programs, tuition assistance, gym and fitness reimbursement, and wellness incentives.
Tech Stack
Categories
About HealthEquity, Inc.
HealthEquity builds a platform for administering Health Savings Accounts and other consumer-directed benefits (FSA, HRA, COBRA, commuter) for employers, advisors, and health plans. It earns fees for account administration and payments and custodial interest on HSA cash, and provides cards, portals, and integrations for members and partners. Founded in 2002 and headquartered in Draper, Utah, the public company trades on NASDAQ as HQY and serves over 16 million members.