Cloud Security Operations Engineer

Experience in cloud security operations, vulnerability management, and cloud security posture management.

The candidate will be responsible for operating and managing enterprise Cloud-Native Application Protection Platform (CNAPP) solutions such as Orca Security, Wiz, or Prisma Cloud to continuously monitor, assess, and improve the organization's security posture across multi-cloud environments, including AWS, Microsoft Azure, GCP, and OCI.

The role involves identifying and investigating cloud security risks, misconfigurations, vulnerabilities, excessive permissions, publicly exposed resources, insecure configurations, attack paths, and potential threats to cloud workloads. The candidate will work closely with Cloud Engineering, DevOps, Infrastructure, IAM, Security Architecture, and SOC teams to prioritize risks, coordinate remediation, validate security controls, and ensure compliance with enterprise cloud security policies and standards.

The ideal candidate should have strong hands-on experience with CNAPP platforms, a good understanding of cloud infrastructure and security technologies, and the ability to translate security findings into actionable remediation activities.

Responsibilities:

• CNAPP Platform Operations: Operate and administer CNAPP solutions such as Orca Security, Wiz, or Prisma Cloud. Manage cloud integrations, asset discovery, workload visibility, security policies, platform health, and monitoring coverage across multi-cloud environments.
• Cloud Security Posture Management (CSPM): Continuously monitor cloud environments for security misconfigurations, policy violations, public exposure, insecure storage, weak encryption, excessive permissions, and deviations from approved security baselines.
• Cloud Vulnerability Management: Identify, analyze, prioritize, and track vulnerabilities across cloud workloads, virtual machines, containers, operating systems, and cloud-native services. Coordinate patching and remediation with relevant engineering teams and validate closure.
• Attack Path and Exposure Management: Analyze CNAPP attack paths to identify combinations of vulnerabilities, excessive permissions, public exposure, and sensitive data access that could lead to privilege escalation, lateral movement, or data exfiltration.
• Cloud Detection and Response (CDR): Monitor and investigate cloud security events involving suspicious activities, anomalous access, unauthorized API calls, privilege escalation, unusual network connections, and potential workload compromise. Perform triage, identify false positives and duplicate events, and escalate genuine threats to SOC/Incident Response teams.
• Cloud IAM Security Monitoring: Identify excessive permissions, overprivileged IAM roles, unused permissions, risky service accounts, inactive access keys, insecure trust relationships, and privilege escalation risks across AWS IAM, Azure RBAC, GCP IAM, and OCI IAM.
• Cloud Infrastructure Security: Monitor and assess security configurations across cloud compute, storage, databases, networking, containers, Kubernetes, and serverless workloads. Identify configuration weaknesses and coordinate remediation.
• Security Hardening and Patch Management: Monitor compliance with OS hardening requirements, secure configuration baselines, vulnerability remediation, and patch management requirements across Windows and Linux workloads.
• Cloud Network Security: Identify network security risks involving publicly exposed resources, unrestricted security groups, firewall misconfigurations, insecure ingress/egress rules, inadequate network segmentation, and exposed management interfaces.
• Cloud Security Governance: Monitor compliance with enterprise cloud security policies, technical standards, configuration baselines, and operational security controls. Track exceptions, remediation activities, and control implementation evidence.
• Security Incident Investigation: Support cloud security incident investigations through collection and preservation of cloud audit logs, CNAPP events, workload metadata, configuration snapshots, and other relevant evidence. Assist with root cause analysis and remediation.
• SIEM and Security Monitoring Integration: Support integration of CNAPP events and cloud security logs with enterprise SIEM platforms such as Splunk or Microsoft Sentinel. Correlate security events and improve detection and investigation capabilities.
• Operational Reporting: Develop and maintain dashboards and reports covering cloud asset inventory, CNAPP integration coverage, security posture, critical vulnerabilities, CDR events, attack paths, remediation SLAs, and security control effectiveness.
• Cloud Security Operations Improvement: Identify recurring security issues, recommend automation opportunities, improve quality, reduce false positives, and strengthen cloud security monitoring and remediation processes.
• Vendor and Stakeholder Coordination: Work with CNAPP vendors and internal Cloud Engineering, DevOps, Infrastructure, IAM, SOC, and Security Architecture teams to investigate issues, resolve findings, and improve cloud security posture.

CNAPP / Cloud Security Platforms:

• Hands-on experience with at least one enterprise CNAPP platform: Orca Security, Wiz, or Prisma Cloud.
• Understanding of CSPM, Cloud Workload Protection (CWPP), Cloud Infrastructure Entitlement Management (CIEM), Cloud Detection and Response (CDR), and attack path analysis.
• Experience with cloud asset discovery, vulnerability assessment, security policy configuration, finding triage, and remediation tracking.
• Understanding of CNAPP integration coverage, workload visibility, platform health, and operational reporting.

Cloud Platforms:

• Good understanding of AWS, Microsoft Azure, and GCP; exposure to Oracle Cloud Infrastructure (OCI) is desirable.
• Knowledge of cloud accounts, subscriptions, projects, resource hierarchies, and shared responsibility models.
• Understanding of cloud-native security services, IAM, networking, compute, storage, and logging.

Cloud Infrastructure and Workload Security:

• Knowledge of Windows and Linux operating systems, virtual machines, storage, databases, and serverless services.
• Understanding of Docker, container security, and Kubernetes security fundamentals.
• Knowledge of OS hardening, patch management, vulnerability remediation, and secure configuration baselines.
• Understanding of Terraform, CloudFormation, or other Infrastructure as Code (IaC) technologies is desirable.

Cloud Networking and IAM Security:

• Understanding of VPC/VNet, subnets, routing, security groups, network ACLs, firewalls, VPNs, private endpoints, and network segmentation.
• Knowledge of AWS IAM, Azure RBAC, GCP IAM, service accounts, workload identities, privileged access, and least-privilege principles.
• Ability to identify excessive permissions, risky access configurations, and cloud identity-related security risks.

Security Monitoring and Incident Response:

• Knowledge of cloud audit logs, security telemetry, triage, incident investigation, and escalation procedures.
• Familiarity with SIEM solutions such as Splunk or Microsoft Sentinel.
• Understanding of cloud threat detection, vulnerability management, incident response, and root cause analysis.
• Knowledge of digital evidence collection and preservation is desirable.

Security Governance and Standards:

• Understanding of cloud security policies, technical baselines, configuration standards, and operational controls.
• Familiarity with CIS Benchmarks, NIST security frameworks, ISO 27001, and cloud provider security best practices.
• Knowledge of security risk assessment, remediation SLAs, exceptions, and risk acceptance processes.

Soft Skills:

• Strong analytical, troubleshooting, and problem-solving skills.
• Ability to investigate complex cloud security findings and distinguish genuine risks from false positives.
• Strong collaboration skills to work with Cloud Engineering, DevOps, Infrastructure, IAM, SOC, and Security Architecture teams.
• Ability to communicate technical security risks and remediation recommendations clearly.
• Strong ownership and accountability for tracking security findings through remediation and closure.
• Ability to prioritize activities based on risk severity, business impact, workload criticality, and exposure.
• Good documentation, reporting, and presentation skills.
• Ability to work independently and manage multiple security operations activities.
• Willingness to continuously learn and adapt to evolving cloud technologies, security threats, and CNAPP capabilities.

Education & Experience:

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.
• 5-7 years of experience in Information Security, Cloud Security Operations, Infrastructure Security, Vulnerability Management, or related cybersecurity domains.
• Demonstrable hands-on experience operating at least one CNAPP platform, preferably Orca Security, Wiz, or Prisma Cloud.
• Practical experience monitoring cloud environments, investigating security findings, identifying vulnerabilities, and coordinating remediation.
• Experience working with AWS, Azure, or GCP cloud environments.
• Experience collaborating with Cloud Engineering, DevOps, Infrastructure, IAM, and SOC teams.
• Familiarity with enterprise security monitoring, incident management, and cloud security governance.

Skills

AWS, Azure, CDR, CIEM, CNAPP, CSPM, CWPP, GCP, ORCA, Prisma Cloud, Wiz