Senior Cloud Security Engineer

The Senior Cloud Security Engineer is a vital technical position that focuses on designing, implementing, and automating strong security controls in our cloud environments, mainly within AWS and considering GCP. This role plays a critical part in enhancing our cloud security posture, securing Included Health's infrastructure, and preventing unauthorized access to sensitive personal health information (PHI). You will be instrumental in creating advanced security solutions through coding (primarily Python and Go) and automation (Terraform) to tackle vital challenges in access control, development environment security, and infrastructure hardening.

As a key technical partner to our infrastructure and engineering teams, you will foster a culture of security by design and help implement solutions that effectively reduce HIPAA incidents.

Key Responsibilities:

• Design and implement a comprehensive authorization framework for cloud resources, focusing on user roles, resource-specific restrictions, and access control.
• Lead the implementation of Just-In-Time (JIT) access control systems to minimize standing privileges for teams.
• Collaborate with engineers to integrate data classification into access control mechanisms.
• Develop security automation scripts and tools using Python or Go for streamlined operations and incident response.
• Maintain clean, testable code for security automation and tool development.
• Implement Infrastructure as Code (IaC) with Terraform for security configuration management.
• Contribute to centralized security controls like a web application firewall (WAF).
• Partner with teams to establish secure practices in the development toolchain.
• Design secure mechanisms for webhook testing in local environments.
• Define container security hardening standards in collaboration with teams.
• Assist in remediating legacy cloud environments, especially in GCP.
• Implement solutions for data access control compliant with regulatory requirements.
• Collaborate across teams to integrate automated security controls into systems and CI/CD pipelines.
• Serve as a subject matter expert on cloud security, providing guidance and conducting code reviews.
• Support change management efforts related to new security protocols.
• Conduct security assessments and contribute to threat modeling and incident response.
• Document security architectures, controls, automation scripts, and incident response procedures.

Qualifications:

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 5+ years of experience in cloud security, particularly in AWS.
• Hands-on software development experience in Python and Go for security automation and tool building.
• Proven experience designing and implementing robust authorization and access control frameworks.
• Proficiency in writing and maintaining Terraform modules for Infrastructure as Code.
• Experience with containerization technologies like Docker and Kubernetes.
• Familiarity with SDLC security and CI/CD pipeline security integration.
• Experience with security logging, monitoring, and alerting tools.
• Knowledge of cloud security frameworks and regulations, especially HIPAA.

Compensation: The salary for this position ranges based on location and experience, with a starting base salary dependent on several job-related factors.

Benefits: Our comprehensive benefits package includes a remote-first culture, 401(k) plan, medical, vision, and dental coverage, paid time off, 12 weeks of paid parental leave, and more.

About Included Health: Included Health is revolutionizing healthcare by delivering integrated virtual care and navigation, ensuring everyone gets high-quality care throughout their health journey.