Lead risk-based design and assessment of security controls across cloud services, platforms, and reference architectures; establish standardized control baselines and reusable patterns for AWS, Azure, and GCP.
Chair or co-chair governance forums, make informed risk acceptance decisions, and drive timely remediation, deviation tracking, and benefits realization.
Partner with senior leaders across engineering, product, and risk to embed “security by design,” ensuring deep integration with security operations, threat intelligence, IAM, network security, and data protection.
Set the operating model for infrastructure as code security: define guardrails, policy as code, and automated pre-commit/pre-deploy controls; oversee security reviews for Terraform and platform engineering pipelines.
Establish and maintain authoritative documentation, standards, and playbooks; implement agile delivery mechanisms for security programs at scale.
Build, mentor, and lead a high-performing matrixed team of security engineers and risk analysts; develop talent, clarify accountabilities, and cultivate a culture of ownership and continuous improvement.
Define and report control effectiveness and residual risk through executive-ready dashboards; brief senior stakeholders, audit, and regulators; ensure audit readiness and sustainable evidence practices.
Drive the tooling and automation strategy for cloud security, including build vs buy evaluations, vendor management, and integration with existing telemetry and SOAR platforms.
Strengthen cloud incident preparedness and response by leading threat modeling, tabletop exercises, and post-incident reviews that translate lessons learned into control enhancements.
Apply reuse-first, AI-assisted practices within SDLC/toolchain routines to strengthen security testing and control validation, ensuring traceability/auditability and alignment to resiliency and security expectations.
Required Qualifications, Capabilities, and Skills
Formal training or certification on security engineering concepts and advanced applied experience.
Skilled in planning, designing, and implementing enterprise-level security solutions.
Demonstrated experience using enterprise-authorized AI capabilities within the work environment to support security engineering workflows with strong validation habits and awareness of data sensitivity.
Ability to review and validate AI-assisted code/security recommendations before adoption, escalating uncertainty and ensuring outcomes align to security, resiliency, and auditability expectations.
Advanced in one or more programming languages.
Proficient across SDLC execution, including agile methodologies such as CI/CD, application resiliency, and security.
Experience with threat modeling, discovery, vulnerability, and penetration testing.
Preferred Qualifications, Capabilities, and Skills
Deep expertise securing public cloud at scale, spanning identity and access management, network segmentation, data protection, logging/monitoring, and native cloud services across AWS, Azure, and/or GCP.
Proven leadership of cross-functional security programs with measurable outcomes; adept at influencing VP+ stakeholders and navigating complex prioritization across multiple platforms and business lines.
Exceptional executive communication and stakeholder management skills, including experience engaging internal audit and external regulators with clear narratives, metrics, and remediation roadmaps.
Demonstrated ability to translate policy and risk requirements into practical designs and policy as code guardrails that balance delivery velocity with control effectiveness.
Hands-on familiarity with Terraform and infrastructure as code security, DevSecOps and CI/CD concepts, and enforcement frameworks within modern development workflows.
Strong program execution under tight timelines; highly self-directed with a bias for action, ownership, and outcome orientation.
Advanced cloud and security certifications are a plus; experience deploying and operating CSPM/CIEM/CWPP solutions is advantageous.
