Staff Cloud Security Engineer

Skills

About the Role

You will build and improve controls protecting Arena's cloud infrastructure in a hands-on role. You will design the workload identity model, own machine secrets and rotation, set network reach rules, build detections and response steps, embed security checks in infrastructure code and pipelines, assess vendor access, lead incident response and share on-call. The role is onsite in San Francisco.

Requirements

• 6+ years in security or infrastructure engineering, with 3+ focused on cloud security in production
• Deep hands-on experience securing AWS, GCP, and Cloudflare
• Prior ownership of cloud security decisions
• Depth in workload identity: OIDC, workload identity federation, IAM design, secret managers
• Experience running credential rotation without outage
• Cloud detection and response experience
• Terraform or similar IaC and a language such as Python, Go or TypeScript
• Experience securing CI/CD such as GitHub Actions
• Hands-on use of AI tooling
• Sound risk judgment

Responsibilities

• Design the cloud identity model with least-privilege IAM, workload identity federation and short-lived credentials
• Own machine secrets and rotation end to end
• Set rules for what each environment and service may reach
• Build security detections and alerts and write response steps
• Build cloud security checks into infrastructure code and build pipelines
• Secure credentials and permissions used by source control, build pipelines and cloud deployments
• Assess technical access requested by vendors and managed platforms
• Lead technical response to cloud infrastructure security events
• Keep cloud security posture visible and improve it
• Share the security on-call rotation

Benefits

• Comprehensive health and wellness benefits, including medical, dental, vision, and additional support programs