Enablement, product engineering and local infrastructure teams globally.
Key areas of responsibility for the Cloud Security Engineer include
Cloud Security Controls: Design, deploy, and operate security controls across AWS and GCP, covering posture management (CSPM), workload protection (CWPP), identity and entitlements (CIEM), and network security.
Security Platform Engineering: Engineer and operate cloud security platforms such as Wiz, CrowdStrike Cloud Security, and Palo Alto Networks: onboard accounts and projects, tune policies, and route findings into existing workflows.
Baselines & Guardrails: Define and maintain secure baselines for AWS accounts and GCP projects, including organization policies, IAM, encryption, logging, and network segmentation.
Containers & Kubernetes: Secure container workloads on EKS and GKE, from image build through to runtime.
Data Protection: Protect sensitive data in the cloud and reduce the risk of data exfiltration.
Vulnerability Management & Incident Response: Prioritize cloud vulnerabilities and misconfigurations by risk, drive remediation with the owning teams, and support the Cyber Security & Assurance teams in the investigation of and response to cloud security incidents.
DevSecOps: Embed security checks in CI/CD pipelines (infrastructure-as-code scanning, SAST, secret detection, and image scanning), maintain policy as code, and review Terraform modules for security.
Automation: Automate remediation, evidence collection, and reporting through scripting and APIs.
Governance & Guidance: Build dashboards and KPIs on cloud security posture, present them in governance forums, and give engineering teams practical guidance on implementing controls.
Education: Undergraduate or postgraduate degree in a technical discipline (Computer Science, Engineering, Information Security, or a related field), or equivalent experience.
Cloud Security Experience: 5+ years of hands-on experience securing workloads in AWS and GCP, with depth in at least one and working knowledge of the other.
Security Platforms: Hands-on experience with at least one cloud-native application protection platform, such as Wiz, CrowdStrike Cloud Security, or Palo Alto Networks Prisma Cloud / Cortex Cloud.
Native Cloud Controls: Strong knowledge of AWS and GCP security controls, including IAM, key management, organization-level policies, logging, and network controls.
Infrastructure as Code & CI/CD: Experience with Terraform and with securing CI/CD pipelines.
Scripting & Automation: Proficiency in Python or a similar language.
Containers & Application Security: Understanding of container and Kubernetes security, and of application security fundamentals including the OWASP Top 10.
Data Protection: Experience protecting sensitive data and mitigating data exfiltration risk.
Certifications: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP or vendor certifications from Wiz, CrowdStrike, or Palo Alto Networks are an advantage.
Frameworks & Industry: Working knowledge of CIS Benchmarks, NIST, and ISO 27001, and familiarity with commodity trading or financial services environments, are an advantage.
Languages: Fluent English required and good knowledge of French an advantage
Soft Skills that will help you stand out
Autonomous & Proactive: Understands functional and technical requirements, spots gaps, and proposes improvements without waiting to be asked.
Clear Communicator: Explains technical risk in business terms to engineers and non-technical stakeholders alike.
Highly Collaborative: Builds trust with engineering teams and treats security as something that enables delivery.
Pragmatic & Outcome-Oriented: Prioritizes by risk and focuses on fixes that measurably reduce exposure.
Decisive & Action-Oriented: Comfortable setting priorities and delivering at pace in a flat, high-ownership culture.
Intellectually Curious: Keeps up with new cloud services and the threats that come with them.
What We Offer
Scale and Complexity: The opportunity to secure demanding, high-stakes cloud workloads across 40+ offices and mission-critical trading systems.
Modern Security Stack: Hands-on work with leading cloud security platforms across AWS and GCP.
Real Ownership: Direct influence on how cloud security is designed and run at Vitol, with room to shape standards and tooling.
Flat, Meritocratic Culture: A non-hierarchical environment where good ideas win on merit, decisions are made rapidly, and bureaucracy is strictly minimized.
Global Footprint: Work with diverse, highly talented technology and business colleagues across Vitol's global network in Geneva, London, Houston, Singapore, and beyond.
