Responsibilities
- Own security architecture, cloud guardrails, and automation patterns while partnering with platform and infrastructure teams on implementation.
- Own and evolve CSPM capabilities, including policies, guardrails, and automated remediation.
- Engineer and maintain cloud network security controls, including segmentation, isolation, cloud-native firewalls, security groups, Application Gateway, WAF configurations, and secure ingress and egress patterns.
- Define and enforce security best practices for AKS and EKS environments, including RBAC, network policies, workload isolation, and cluster hardening.
- Partner with engineering teams on architecture reviews for new services, platforms, and major changes.
- Engineer and maintain identity and access controls for cloud and production environments, including least privilege, workload identity, service principals, and conditional access.
- Define FinOps guardrails that balance cost optimization with security and compliance.
- Develop tooling, automation, and self-service workflows that reduce manual effort and improve consistency.
- Communicate security risks and technical recommendations to engineering teams, leadership, and cross-functional stakeholders.
- Mentor junior engineers and help raise the organization’s security maturity.
Requirements
- At least 6 years of experience in cloud security, security engineering, or cloud platform engineering.
- Deep hands-on security experience in Azure or AWS; experience with both is strongly preferred.
- Hands-on experience securing production AKS or EKS environments, including RBAC, network policies, workload identity, admission controls, image and runtime controls, and cluster hardening.
- Proven experience with cloud network security, including firewalls, WAFs, network segmentation, and secure connectivity patterns.
- Strong understanding of cloud security architecture, shared responsibility models, secure service design, and defense in depth.
- Experience with preventive security controls, CSPM, policy enforcement, and secure cloud baselines.
- Cloud automation experience with Infrastructure as Code tools such as Terraform, Bicep, or CloudFormation, plus scripting with Python, PowerShell, Bash, or similar languages.
- Ability to work independently, own complex problem spaces, and deliver practical, scalable solutions.
- Strong communication skills and comfort providing architecture-level guidance to engineering teams.
- Experience working in regulated environments.
- Preferred experience supporting FedRAMP, SOC 2, ISO 27001, or NIST compliance programs.
- Familiarity with CI/CD pipelines and DevSecOps practices is preferred.
- Experience with cloud identity and access management, including RBAC, workload identity, and service principals, is preferred.
Benefits
- Where a required location applies, hybrid work with up to three days per week in the office and the remaining days remotely.
- Global team environment focused on purpose, growth, balance, and employee support.
About Semperis
For security teams charged with defending hybrid and multi-cloud environments, Semperis ensures the integrity and availability of critical enterprise directory services at every step in the cyber kill chain and cuts recovery time by 90%. Purpose-built for securing hybrid identity environments—including Active Directory, Entra ID, and Okta—Semperis’ AI-powered technology protects over 100 million identities from cyberattacks, data breaches and operational errors. The world’s leading organizations trust Semperis to spot directory vulnerabilities, intercept cyberattacks in progress and quickly recover from ransomware and other data integrity emergencies. Semperis is headquartered in Hoboken, New Jersey, and operates internationally, with its research and development team distributed throughout the United States, Canada and Israel. Semperis hosts the award-winning Hybrid Identity Protection conference and podcast series (www.hipconf.com) and built the community hybrid Active Directory cyber defender tools, Purple Knight (www.semperis.com/purple-knight/) and Forest Druid. The company has received the highest level of industry accolades, recently named to Inc. Magazine’s list of best workplaces for 2024 and ranked the fastest-growing cybersecurity company in America by the Financial Times. Semperis is a Microsoft Enterprise Cloud Alliance and Co-Sell partner and is a member of the Microsoft Intelligent Security Association (MISA).