This is a contract position for a Cloud Policy as Code Engineer based in Phoenix, Arizona, offering a 12+ month engagement. The role combines hands-on cloud security engineering with policy-as-code implementation, focusing on Oracle Cloud Infrastructure (OCI) security assessment, governance, and automation.
Responsibilities
Conduct security reviews of OCI services, SaaS applications, architectures, integrations, and configurations to identify risks, control gaps, and remediation opportunities.
Evaluate cloud and SaaS solutions against enterprise security standards, policies, regulatory requirements (NIST, ISO 27001, CSA CCM, CIS), and secure configuration baselines.
Assess security posture across Identity & Access Management (IAM), Network Security, Data Protection & Encryption, Logging & Monitoring, Compute & Container Security, API Security, SaaS Security Posture Management (SSPM), AI/GenAI Security, and Third-Party & Vendor Risk.
Support development and maintenance of OCI and SaaS security standards, guardrails, and onboarding requirements.
Implement OCI-native security controls and governance capabilities using Infrastructure-as-Code (Terraform) and policy-as-code frameworks such as Sentinel or Open Policy Agent (OPA).
Support deployment and integration of security monitoring, posture management, and compliance capabilities.
Perform SaaS onboarding assessments, certification reviews, and posture assessments including configuration drift and identity governance evaluation.
Show the full description
Support SaaS inventory management, Shadow IT discovery, and vendor security assessments.
Partner with cloud engineering, architecture, DevOps, security operations, compliance, and risk teams throughout design reviews, onboarding, exception management, and remediation efforts.
Document findings, recommendations, and evidence to support governance and certification decisions.
Qualifications
Required
Experience performing cloud security assessments within Oracle Cloud Infrastructure (OCI) or comparable cloud platforms.
Strong understanding of Identity & Access Management, Network Security, Data Protection, Cloud Logging & Monitoring, and Container & Platform Security.
Experience conducting SaaS security reviews and certifications.
Hands-on experience with policy-as-code implementation and tools such as HashiCorp Sentinel, Open Policy Agent (OPA), or similar technologies.
Experience with Infrastructure-as-Code, particularly Terraform, and cloud architecture design review.
Knowledge of cloud shared responsibility models and secure-by-design principles.
Strong written and verbal communication skills.
Preferred
Oracle Cloud Infrastructure certifications.
Experience with OCI Cloud Guard, Security Zones, and Oracle SaaS platforms.
Familiarity with SaaS Security Posture Management (SSPM) platforms and Cloud Access Security Broker (CASB) technologies.
Experience with automated compliance tooling and policy-as-code frameworks.
Experience supporting AI/GenAI security assessments.
Experience working with GitHub, CI/CD pipelines, and cloud security automation.
Prior banking or financial services industry experience.
