Penumbra - Alameda, CA
posted 4 months ago
The Senior Cloud Security Engineer will be a key member of the Information Security & Compliance team, focusing on a highly technical, hands-on, analytical, and process-oriented approach. This role involves collaborating with product teams to engineer security solutions and provide operational support across a hybrid cloud environment. The engineer will ensure compliance with legal and regulatory requirements while maintaining the company's information security policies, standards, and industry best practices. In this position, the engineer will be responsible for designing and developing innovative security solutions to protect applications and data deployed in the cloud. This includes developing and sustaining the security vision and strategy for all deployments across infrastructure and software, leveraging both native and third-party products as necessary. The role also entails improving security reporting, coordinating vulnerability management, penetration testing, and infrastructure compliance, as well as developing security dashboards to provide an overview of the security posture and ensure that deviations from the norm are visible and addressed appropriately. The Senior Cloud Security Engineer will have hands-on responsibility for all Azure cloud security and enterprise SaaS application security. Continuous monitoring of the effectiveness of security controls will be essential, involving comprehensive assessments across various domains such as Identity and Access Management (IAM), secure CI/CD pipelines, incident management, vulnerability management, and red-teaming exercises. Collaboration with the operations team on Security Operations Center (SOC) tools, including SIEM, UEBA, NDR, and SOAR, will be necessary to define use cases and ensure full coverage of the MITRE framework. Additionally, the engineer will identify, track, and resolve security issues and gaps across the Azure tenant, cloud infrastructure, and functional services across IaaS, PaaS, SaaS, and CaaS. Responsibilities also include building, deploying, and managing security tools, automating security controls, processes, and services, as well as evaluating and responding to alerts and events from security tools to minimize false positives. The engineer will develop event response documentation and processes, collaborate with security leadership, engineering, and compliance to execute security strategies and roadmaps, and assist other teams in solving security issues in compliance with business requirements and best practices. The role requires reviewing company architecture and design through a security lens to provide actionable, timely requirements and recommendations, serving as a subject matter expert for security tools, applications, and processes, and developing, enforcing, and auditing cloud security policies, standards, and procedures.