{bc}
Apply
workday

Senior Cloud Security Engineer

Greystar
Remote, USA
Full-time
Senior · 8+ years experience
Remote
USD 140000-170000 / year
Discovered 3 weeks ago
awsazurebashdatabrickskubernetespowershell

Full Job Posting

What You Will Do:

  • Cloud Security Architecture & Standards
  • Define and own cloud security architecture patterns across cloud platforms - IAM guardrails, network segmentation, encryption standards, and secrets management - that the Infrastructure, Delivery, and Reliability tracks build against.
  • Own cloud Policy as code, including custom policy definitions, initiative assignments, and enforcement-mode governance across the cloud estate.
  • Establish secure-by-default reference patterns - landing zone security baseline, mandatory private endpoint use, default-deny network posture - in direct partnership with the Principal Cloud Engineer.
  • Partner with Information Security architecture so enterprise security policy translates correctly into cloud-native controls, acting as the translator of record between enterprise policy and cloud implementation.
  • Application, Pipeline & Supply-Chain Security
  • Build and configure security tooling directly into CI/CD pipelines - standing up IaC scanning, container image scanning, and SAST/DAST tools hands-on alongside the Delivery team.
  • Own supply-chain risk review for third-party CI/CD integrations (GitHub Actions, MCP servers, external connectors), partnering with the Senior DevOps Engineer on remediation.
  • Work hands-on with application development and AI/ML teams to harden new cloud-native and AI workloads before they ship - configuring network isolation, securing model endpoints and API keys, and directly fixing findings during the build.
  • Personally triage and remediate critical pipeline findings, working directly in the codebase or configuration with engineering teams to fix root causes.
  • Identity & Access Security (Cloud-Specific)
  • Define least-privilege RBAC and conditional access standards for cloud resources, partnering with Cloud Engineering on execution against established naming and group-based delegation conventions.
  • Own the just-in-time / privileged identity model for privileged cloud roles.
  • Own recurring access reviews and offboarding validation for service principals, managed identities, and human RBAC assignments across the cloud estate.
  • Detection, Response & Operations
  • Partner with Cybersecurity Operations to tune Defender for Cloud recommendations and Sentinel analytics rules for cloud-specific signal, reducing noise and closing detection gaps as new services and connectors come online.
  • Recommend and help prioritize which cloud workloads and connectors get phased into Sentinel next, based on risk and blast radius across the estate.
  • Contribute cloud-specific escalation criteria to the runbooks the Operations Command Center and Cybersecurity Operations execute against.
  • Deliver initial and ongoing training to Cybersecurity Operations on cloud-native anomalies - managed identity misuse, unusual resource provisioning, anomalous Entra ID sign-ins - so detection and tuning quality improve over time.
  • Governance, Risk & Compliance
  • Actively work down the CSPM and vulnerability backlog - rewriting Terraform to close a misconfiguration, migrating a plaintext secret to Key Vault, reconfiguring an identity - personally closing critical and high findings.
  • Map cloud infrastructure controls to relevant compliance frameworks (SOC 2, PCI, CIS Benchmarks) in partnership with enterprise Information Security, translating framework language into actual Azure/AWS configuration.
  • Architecture Review & Technical Authority
  • Serve as the primary cloud security voice in cloud architecture design reviews across Infrastructure, Application Development, and Data Engineering, providing the security assessment that informs whether a design moves forward.
  • Maintain security documentation, reference architectures, and runbooks specific to the cloud estate.
  • Qualifications:
  • Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent professional experience.
  • 8+ years of experience in cloud security, security architecture, or cloud infrastructure engineering with a security focus, including demonstrated experience operating at a senior or principal level.
  • Deep, hands-on, expert-level experience securing Azure environments specifically - Azure Policy, Defender for Cloud, Sentinel, network security groups, and private endpoints - sufficient to set enterprise standards.
  • Solid working knowledge of AWS security services (IAM, Security Hub, GuardDuty, Config) sufficient to extend the same rigor as the estate expands beyond Azure.
  • Experience embedding security into Infrastructure as Code - reviewing and hardening Terraform, ARM, or Bicep - not only auditing after deployment.
  • Experience defining and enforcing CI/CD pipeline security gates: SAST/DAST, container image scanning, dependency scanning, and secrets detection.
  • Expert-level understanding of cloud identity security - Entra ID, RBAC and least-privilege design, just-in-time access, and workload identity federation - deep enough to author an identity architecture.
  • Experience identifying and triaging cloud-specific security signals - anomalous sign-ins, managed identity misuse, unusual resource provisioning - sufficient to train and hand off to an incident response team.
  • Proficiency in scripting and automation (PowerShell, Python, or Bash) for security tooling and remediation at scale.
  • Excellent executive communication skills, with the demonstrated ability to defend a security position persuasively to senior technical leadership and to explain risk and remediation priority to both engineers and non-technical stakeholders.

Preferred Qualifications:

  • Experience securing Databricks or data platform environments specifically, including Unity Catalog permissions models and data plane network isolation.
  • Experience with container and Kubernetes security (AKS), including image provenance and runtime security.
  • Familiarity with securing AI/ML and LLM-adjacent infrastructure - model serving endpoints, API key and secret exposure patterns, and agentic tool or third-party integration risk.
  • Direct experience mapping cloud controls to compliance frameworks (SOC 2, PCI DSS, CIS Benchmarks) in a real audit context.
  • Cloud security certifications (e.g., Microsoft Certified: Cybersecurity Architect Expert, AWS Certified Security - Specialty, CCSP) are a plus but not required.
  • #LI-BB1
  • The salary range for this position is $140,000 - $170,000 USD Annually.
  • #LI-Remote
  • Additional Compensation:
  • Many factors go into determining employee pay within the posted range including business requirements, prior experience, current skills and geographical location.
  • Corporate Positions: In addition to the base salary, this role may be eligible to participate in a quarterly or annual bonus program based on individual and company performance.
  • Onsite Property Positions: In addition to the base salary, this role may be eligible to participate in weekly, monthly, and/or quarterly bonus programs.
  • Robust Benefits Offered:
  • Competitive Medical, Dental, Vision, and Disability & Life insurance benefits. Low (free basic) employee Medical costs for employee-only coverage; costs discounted after 3 and 5 years of service.
  • Generous Paid Time off. All new hires start with 15 days of vacation, 4 personal days, 10 sick days, and 11 paid holidays. Plus your birthday off after 1 year of service! Additional vacation accrued with tenure.
  • For onsite team members, onsite housing discount at Greystar-managed communities are available subject to discount and unit availability.
  • 6-Week Paid Sabbatical after 10 years of service (and every 5 years thereafter).
  • 401(k) with Company Match up to 6% of pay after 6 months of service.
  • Paid Parental Leave and lifetime Fertility Benefit reimbursement up to $10,000 (includes adoption or surrogacy).
  • Employee Assistance Program.
  • Critical Illness, Accident, Hospital Indemnity, Pet Insurance and Legal Plans.
  • Charitable giving program and benefits.
  • Benefits offered for full-time employees. For Union and Prevailing Wage roles, compensation and benefits may vary from the listed information above due to Collective Bargaining Agreements and/or local governing authority.
  • Greystar will consider for employment qualified applicants with arrest and conviction records.
  • Greystar is an equal opportunity employer and does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy, sexual orientation, and gender identity), national origin, age, disability, genetic information, military or veteran status, or any other characteristic protected by applicable law.
  • This position may be performed remotely anywhere within the United States except the state of Alaska.
  • Important Notice: Greystar will never request your banking details or other sensitive personal information during the interview process. Greystar does not conduct any interviews via text or messaging, and all communication will come from official Greystar email addresses (@greystar.com). If you receive suspicious requests, please report them immediately to [email protected].
  • ANTICIPATED CLOSING DATE
  • This date may be subject to change due to evolving business needs.

Qualifications

  • Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent professional experience.
  • 8+ years of experience in cloud security, security architecture, or cloud infrastructure engineering with a security focus, including demonstrated experience operating at a senior or principal level.
  • Deep, hands-on, expert-level experience securing Azure environments specifically - Azure Policy, Defender for Cloud, Sentinel, network security groups, and private endpoints - sufficient to set enterprise standards.
  • Solid working knowledge of AWS security services (IAM, Security Hub, GuardDuty, Config) sufficient to extend the same rigor as the estate expands beyond Azure.
  • Experience embedding security into Infrastructure as Code - reviewing and hardening Terraform, ARM, or Bicep - not only auditing after deployment.
  • Experience defining and enforcing CI/CD pipeline security gates: SAST/DAST, container image scanning, dependency scanning, and secrets detection.
  • Expert-level understanding of cloud identity security - Entra ID, RBAC and least-privilege design, just-in-time access, and workload identity federation - deep enough to author an identity architecture.
  • Experience identifying and triaging cloud-specific security signals - anomalous sign-ins, managed identity misuse, unusual resource provisioning - sufficient to train and hand off to an incident response team.
  • Proficiency in scripting and automation (PowerShell, Python, or Bash) for security tooling and remediation at scale.
  • Excellent executive communication skills, with the demonstrated ability to defend a security position persuasively to senior technical leadership and to explain risk and remediation priority to both engineers and non-technical stakeholders.
  • Experience securing Databricks or data platform environments specifically, including Unity Catalog permissions models and data plane network isolation.
  • Experience with container and Kubernetes security (AKS), including image provenance and runtime security.
  • Familiarity with securing AI/ML and LLM-adjacent infrastructure - model serving endpoints, API key and secret exposure patterns, and agentic tool or third-party integration risk.
  • Direct experience mapping cloud controls to compliance frameworks (SOC 2, PCI DSS, CIS Benchmarks) in a real audit context.
  • Cloud security certifications (e.g., Microsoft Certified: Cybersecurity Architect Expert, AWS Certified Security - Specialty, CCSP) are a plus but not required.
  • #LI-BB1
  • The salary range for this position is $140,000 - $170,000 USD Annually.
  • #LI-Remote
  • Many factors go into determining employee pay within the posted range including business requirements, prior experience, current skills and geographical location.
  • Corporate Positions: In addition to the base salary, this role may be eligible to participate in a quarterly or annual bonus program based on individual and company performance.
  • Onsite Property Positions: In addition to the base salary, this role may be eligible to participate in weekly, monthly, and/or quarterly bonus programs.
  • Competitive Medical, Dental, Vision, and Disability & Life insurance benefits. Low (free basic) employee Medical costs for employee-only coverage; costs discounted after 3 and 5 years of service.
  • Generous Paid Time off. All new hires start with 15 days of vacation, 4 personal days, 10 sick days, and 11 paid holidays. Plus your birthday off after 1 year of service! Additional vacation accrued with tenure.
  • For onsite team members, onsite housing discount at Greystar-managed communities are available subject to discount and unit availability.
  • 6-Week Paid Sabbatical after 10 years of service (and every 5 years thereafter).
  • 401(k) with Company Match up to 6% of pay after 6 months of service.
  • Paid Parental Leave and lifetime Fertility Benefit reimbursement up to $10,000 (includes adoption or surrogacy).
  • Employee Assistance Program.
  • Critical Illness, Accident, Hospital Indemnity, Pet Insurance and Legal Plans.
  • Charitable giving program and benefits.
  • Benefits offered for full-time employees. For Union and Prevailing Wage roles, compensation and benefits may vary from the listed information above due to Collective Bargaining Agreements and/or local governing authority.
  • Greystar will consider for employment qualified applicants with arrest and conviction records.
  • Greystar is an equal opportunity employer and does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy, sexual orientation, and gender identity), national origin, age, disability, genetic information, military or veteran status, or any other characteristic protected by applicable law.
  • This position may be performed remotely anywhere within the United States except the state of Alaska.
  • Important Notice: Greystar will never request your banking details or other sensitive personal information during the interview process. Greystar does not conduct any interviews via text or messaging, and all communication will come from official Greystar email addresses (@greystar.com). If you receive suspicious requests, please report them immediately to [email protected].
  • ANTICIPATED CLOSING DATE
  • This date may be subject to change due to evolving business needs.

Apply for this job in 1 click

Skip the repetitive application forms

Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.

Sarah M.James T.Maya R.

Trusted by over 500,000 job seekers on Base Career

Start Free Today

More from this employer

More jobs at Greystar

Leasing Professional - Foxtail Commons

Ridgeland, USA

Discovered YesterdayFull-time

Maintenance Technician - Part Time - Ridgemont at Stringers Ridge

Chattanooga, USA

Discovered YesterdayPart-time

Service Technician - 505 Summit

Jersey City, USA

Discovered YesterdayFull-time

Maintenance Supervisor - Princeton Groves

Princeton, USA

Discovered YesterdayFull-time

Community Manager - Azure City Living

San Antonio, USA

Discovered YesterdayFull-time

Maintenance Technician - Copper Hills

Albuquerque, USA

Discovered YesterdayFull-time

Sr Service Technician - Visconti at Camelback & The Glen at Old Town

Scottsdale, USA

Discovered YesterdayFull-time

Maintenance Supervisor - Avana South Staion

Tukwila, USA

Discovered YesterdayFull-time