As a Lead Engineer on the Cloud Security team, you'll be the senior technical owner of the engineering workflows and services that make cloud security governance practical at Target scale. You'll help teams understand security requirements, onboard to Cloud Security capabilities, adopt usable controls, and move findings and exception requests through clear, evidence-based processes. You'll build the automation and operational mechanisms that connect security intent with accountable decisions and action.
Beyond deep technical expertise, you have a strong bias for action and a builder's mindset. Cloud security governance sits between security requirements, the capabilities that enforce them, and the product and platform teams who need to use them. You are comfortable operating in that realm – translating approved requirements into clear workflows, engineering reliable onboarding and exception-management capabilities, improving adoption through evidence and feedback, and partnering with decision owners so risks are reviewed and handled consistently. You have the engineering credibility to set technical direction for other engineers as a hands-on IC, and the communication and partnership skills to make governance work well across Target.
Expect to
Serve as the senior technical lead and hands-on owner of Cloud Security governance engineering — setting technical direction, standards, and a roadmap for the workflows, integrations, and automation that other engineers and partners use.
Design, build, and operate a consistent lifecycle for cloud security exceptions: intake, completeness checks, control and asset context, risk and impact information, compensating controls, accountable decision owner, review date, expiry or renewal, and closure evidence.
Make exception requests traceable and decision-ready. Route them to the appropriate policy, architecture, business, or risk-acceptance authority; track decisions and conditions; and escalate overdue or incomplete requests through agreed paths. This role enables and records decisions but does not independently approve policy deviations or accept risk.
Engineer workflows that connect security findings, control requirements, exceptions, remediation ownership, service-level expectations, and closure evidence to the agreed enterprise governance and remediation systems.
Lead onboarding and adoption of Cloud Security capabilities across eligible cloud accounts, projects, workloads, and engineering teams. Partner with platform and software engineers to define practical entry criteria, steps, ownership, enablement materials, support paths, and feedback loops.
Treat onboarding and governance as products: reduce friction and one-off coordination through clear guidance, self-service, automation, reusable patterns, and well-defined service interfaces.
Work with Security Architecture and domain owners to translate approved standards, control requirements, and policy changes into understandable guidance, implementation handoffs, evidence expectations, and governance workflows. Security Architecture and designated authorities retain policy and formal risk decisions.
Establish transparent reporting for adoption, coverage, exception quality and age, review and expiry status, finding ownership, remediation progress, and workflow health. Agree populations, definitions, owners, and baselines before proposing targets; distinguish security outcomes from process and service-health measures.
Improve the quality and usability of governance data by partnering with Cloud Security platform and software engineers, ITDP, service owners, and enterprise workflow owners on asset attribution, ownership, severity, business context, and status feedback.
Build integrations and automation for intake, routing, notifications, evidence capture, status synchronization, and reporting. Use existing enterprise capabilities where they meet the need; make pragmatic build-vs-buy recommendations where they do not.
Operate governance services as production capabilities: own availability, performance, observability, capacity, change and release practices, failure handling, and on-call participation as appropriate. Establish service objectives for workflow reliability, completeness, and timeliness with stakeholders.
Partner closely with the Cloud Security platform and software engineers so policy enforcement, findings, onboarding, exceptions, and remediation operate as a coherent end-to-end experience for engineering teams.
Partner with Security Architecture, BISO/governance, Identity, Network, Data Protection, SecOps/Detection & Response, Vulnerability Management, ITDP, and product, platform, and service owners to clarify responsibilities, decision paths, service interfaces, and operational handoffs.
Support audit, assurance, and leadership reviews by making approved control requirements, exception decisions, evidence, ownership, and remediation status discoverable and reliable. Do not represent working proposals, incomplete evidence, or candidate measures as approved policy or established compliance.
Drive multi-quarter initiatives end-to-end: from problem framing and scoping, through design, build, rollout, adoption, and steady-state operation.
Represent governance capability clearly to senior leadership and staff engineers alike: risk themes, adoption barriers, exception trends, decision needs, workflow health, and tradeoffs — in language tuned to the audience.
Mentor other engineers on the team on security governance engineering, workflow automation, control evidence, and operational practices, and raise the bar for code quality, testing, code review, on-call hygiene, postmortems, and operational excellence.
Continuously reduce toil for both the Cloud Security team and Target's engineering organization — fewer unclear requests, repeated approvals, manual status chases, and one-off onboarding paths; more consistent decisions, self-service, and timely feedback.
Core responsibilities are described within this job description. Job duties may change at any time due to business needs.
About You
4-year degree OR equivalent work experience
7+ years of hands-on experience in technology, security engineering, platform engineering, or a related discipline, including experience building or operating capabilities in a large, complex organization
Demonstrated experience as a senior IC or tech lead owning a technical capability end-to-end at enterprise scale, including setting technical direction that other engineers execute against
Experience designing and improving security, risk, compliance, exception, or remediation workflows, with clear ownership, decision paths, evidence, review periods, and closure
Strong understanding of security governance: how requirements, controls, evidence, exceptions, risk decisions, remediation, and assurance fit together to help an organization manage risk consistently
Experience building, integrating, or automating workflow-oriented services, APIs, data flows, or platforms; fluency in at least one general-purpose programming language and willingness to work hands-on in the team's technology stack
Track record of turning complex requirements into clear processes, usable technical workflows, operational guidance, and measurable outcomes without confusing process completion with risk reduction
Experience driving adoption of security or platform capabilities across multiple engineering teams, including onboarding, enablement, support models, feedback, and continuous improvement
Strong judgment in exception handling: able to gather context, identify missing information and potential compensating controls, explain tradeoffs, and route decisions to the authorized owner without treating an exception as automatically approved
Experience defining operational measures and reporting for workflow quality, adoption, control coverage, remediation, or service health; able to establish trusted definitions and baselines before recommending targets
Experience working with enterprise ticketing, governance, risk, compliance, asset, or security platforms and integrating systems through APIs, event streams, or data pipelines
Hands-on experience with public cloud (GCP preferred; AWS/Azure experience also valued) and familiarity with cloud security controls, findings, and engineering workflows
Working knowledge of security frameworks and standards (e.g., NIST, CIS Benchmarks, ISO/IEC 27001, or CSA CCM) and experience mapping requirements to controls and evidence; able to partner with Security Architecture and control owners rather than acting as the policy authority
Track record of operating production services or business-critical workflows with observability, service objectives, change management, failure handling, and continuous-improvement practices
Comfortable making and defending pragmatic build-vs-buy decisions and knowing when to automate, use an existing enterprise capability, or improve the operating model
Strong cross-functional partner: comfortable working closely with security, risk, product, platform, infrastructure, and service teams to align requirements, adoption plans, decisions, and operational ownership
Effective at representing your work, risks, and tradeoffs to senior leadership, and equally effective explaining the same content to staff engineers in detail
Excellent written and verbal communication skills with strong presentation abilities; able to make security expectations and decision requests clear to both technical and non-technical audiences
Demonstrated curiosity, bias for action, and a genuine builder's mindset — you want to improve and operate the capability, not just describe the process
Preferred Qualifications
Experience in cloud security, cybersecurity, security governance, GRC, or another risk-sensitive technology environment
Experience with cloud security posture management (CSPM/CNAPP), infrastructure-as-code scanning, Kubernetes admission controls, software supply chain controls, or related security capabilities
Experience designing exception workflows, policy lifecycle processes, control evidence models, or security finding-to-remediation programs
Experience with workflow automation, service management, governance/risk/compliance platforms, and enterprise reporting or analytics
Familiarity with cloud platforms and developer workflows, including source control, CI/CD, ticketing, and internal developer platforms
Experience with policy-as-code, infrastructure as code, data quality, or security control testing
This position will operate as a Hybrid/Flex for Your Day work arrangement based on Target's needs. A Hybrid/Flex for Your Day work arrangement means the team member's core role will need to be performed both onsite at the Target HQ MN location the role is assigned to and virtually, depending upon what your role, team, and tasks require for that day. Work duties cannot be performed outside of the country of the primary work location, unless otherwise prescribed by Target. Click here if you are curious to learn more about Minnesota.
Benefits Eligibility
Please paste this url into your preferred browser to learn about benefits eligibility for this role: https://tgt.biz/BenefitsForYou_E
Americans with Disabilities Act (ADA)
In compliance with state and federal laws, Target will make reasonable accommodations for applicants with disabilities. If a reasonable accommodation is needed to participate in the job application or interview process, please reach out to candidate.accommodations@HRHelp.Target.com. Non-accommodation-related requests, such as application follow-ups or technical issues, will not be addressed through this channel.
