4 days ago
Charlotte, NC, USA or Dallas, TX, USAStaff+
Responsibilities
- Lead technical design reviews and establish standards for building, testing, and shipping cloud security controls.
- Mentor and coach engineers while resolving complex technical issues and influencing engineering practices across teams.
- Design enterprise-scale policy pipelines, event-driven remediation systems, API contracts, and integrations with identity, logging, observability, CMDB, and ITSM systems.
- Build preventive and detective controls using CloudFormation, Terraform, and Rego/OPA, and integrate them into CI/CD pipelines.
- Automate posture checks, drift detection, and event-driven remediation at organizational scale.
- Engineer AWS security controls including SCPs, RCPs, permission boundaries, resource policies, identity policies, and pipeline guardrails.
- Operationalize CSPM/CNAPP findings into enforceable automated controls and measure control coverage and effectiveness.
- Support privileged access controls, cloud account governance, audit responses, on-call rotation, and special projects.
Requirements
- At least seven years of related work experience, with four or more years in cloud or security engineering preferred.
- Production-grade programming experience in Python or an equivalent language and extensive hands-on infrastructure-as-code experience.
- Hands-on expertise with AWS, GCP, or Azure, preferably AWS, including organization-wide account structures, landing zones, and cross-account security patterns.
- Experience leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction without direct authority.
- Strong understanding of trust boundaries, least privilege, blast radius, and security threat modeling.
- Experience with AWS IAM policy mechanics, including inline and customer-managed policies, permission boundaries, SCPs, RCPs, and resource and identity policies.
- Experience integrating policy-as-code with engineering teams, CI/CD systems, code repositories, pipelines, and cloud security tooling.
- Experience working in regulated or audit-driven environments.
- An undergraduate degree in a related field or an equivalent combination of training and experience is required.
- AWS Security Specialty or Professional-level AWS certification is preferred but not required.
Benefits
- Hybrid working model with flexibility and opportunities for in-person learning, collaboration, and connection.
- Visa sponsorship is not offered for this position.
Tech Stack
Categories
About Vanguard
Vanguard is an investment management company offering low-cost index and active mutual funds, ETFs, brokerage, retirement plans, and financial advice for individual, institutional, and advisor clients. Founded in 1975 by John C. Bogle and headquartered in Valley Forge, PA, it operates a client-owned structure in which its funds own the firm. Its business model centers on asset-based management and advisory fees.