{"id":4228755,"url":"https://alion.io/job/arena-software-engineer-staff-cloud-security-engineer","title":"Software Engineer - Staff Cloud Security Engineer","company":{"id":1017,"name":"Arena","domain":"arena.ai","url":"https://alion.io/company/arena","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":83,"open_postings":12,"ghost_share":0,"stale_share":0.5,"repost_share":0,"time_to_fill_p50_days":73,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Cloudflare","optional":false},{"name":"GCP","optional":false},{"name":"GitHub Actions","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Python","optional":false},{"name":"Terraform","optional":false},{"name":"TypeScript","optional":false},{"name":"Databricks","optional":true},{"name":"ISO 27001","optional":true},{"name":"Kubernetes","optional":true},{"name":"PostgreSQL","optional":true},{"name":"SOC 2","optional":true},{"name":"Vercel","optional":true}],"status":"live","first_seen_at":"2026-11-13T06:08:36Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T08:58:12Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Arena Intelligence\nArena is the platform for evaluating how AI models perform in the real world. Founded by researchers from UC Berkeley's SkyLab, we're on a mission to measure and advance the frontier of AI for real-world use, and to build the foundation for everyone to understand, shape, and benefit from it.\nTens of millions of people use Arena each month to evaluate how frontier systems handle the work they actually do. The preferences they share power the most transparent, rigorous, and human-centered evaluations in AI. Leading AI labs, enterprises, and independent researchers rely on our work and open datasets to understand how models behave in real workflows: agentic coding, creative generation, professional productivity, and beyond. We go beyond leaderboards and decompose what human experience reveals about AI, so models advance toward the work people actually do.\nWe're a team of researchers, academics, builders, and creatives from UC Berkeley, Google, Stanford, and DeepMind. We seek truth, move fast, and value craftsmanship, curiosity, and impact over hierarchy. We're building a company where thoughtful, curious people from all backgrounds can do their best work together, in an office culture that radiates excellence, energy, and focus.\nABOUT THE ROLE\nWe are looking for a staff-level cloud security engineer to build and improve the controls that protect Arena's cloud infrastructure. You will set how workloads prove who they are, where machine credentials live and how they rotate, what our services can reach, and how we know when something is wrong. Then you will build the controls that enforce it, in code.\nThis is a hands-on seat. You will do the work, not direct it from a distance.\nOur engineers build on cloud and managed platforms for hosting, data, workflows, source control, and builds. You will set the security requirements for workload identity, machine credentials, and cloud access across them.\nYou'll work closely with platform, infrastructure, and product engineers to set cloud security requirements and build controls into the infrastructure they run.\nThis role is onsite in our San Francisco office and reports to the Head of Security.\nYOU'LL\nDesign the cloud identity model for workloads, not just administer it. Least-privilege IAM, workload identity federation, and short-lived credentials. You decide what a workload can do and how it proves who it is.\n\nOwn machine secrets and rotation end to end. Every machine credential has an owner, a home in a central secret manager, and a rotation path that has been run, so rotating a key is routine and doesn't take the product down.\n\nSet the rules for what each environment and service may reach, including limits on outbound connections, separation between environments, and the boundaries around agent runtimes.\n\nBuild security detections and alerts for high-risk changes to cloud infrastructure and build systems, and write response steps a colleague can follow without you.\n\nBuild cloud security checks into infrastructure code and build pipelines, so the secure path is the easiest one.\n\nSecure the machine credentials and permissions used by source control, build pipelines, and cloud deployments.\n\nAssess the technical access requested by vendors and managed platforms before onboarding.\n\nLead technical response to cloud infrastructure security events, working with the affected teams through recovery.\n\nKeep cloud security posture visible to engineering and leadership, and improve it continuously.\n\nShare the security on-call rotation.\n\nYOU'LL HAVE\n6+ years in security or infrastructure engineering, with at least 3 focused on cloud security in production.\n\nDeep, current, hands-on experience securing AWS, GCP, and Cloudflare. You can describe what you built or configured in the last three months at keyboard level.\n\nYou have owned cloud security somewhere, not just worked a findings queue. You have made calls about how IAM and secrets should work, defended them, and lived with what they cost. You can name one you got wrong and changed.\n\nReal depth in workload identity. OIDC, workload identity federation, IAM design, and secret managers. You can explain how a workload proves who it is without a stored key.\n\nRotation you have actually run. You can walk through rotating a production database or API credential without an outage, and what you would do differently next time.\n\nDetection and response in the cloud. You have written detections, been paged by them, and investigated a real event from cloud audit logs.\n\nComfort in Terraform or a similar infrastructure-as-code tool, and in at least one language for automation such as Python, Go, or TypeScript.\n\nExperience securing build pipelines and CI/CD, such as GitHub Actions and deployment credentials.\n\nHands-on with AI tooling in your own work. You use AI to build, script, and investigate, and you know where it belongs in a security workflow and where it doesn't.\n\nJudgment about risk. You can tell a real exposure from a theoretical one, and say plainly which is which.\n\nComfort improving existing systems and documentation while keeping work moving.\n\nBONUS POINTS\nSecuring serverless platforms such as Vercel\n\nSecuring infrastructure for AI agent runtimes or sandboxed code execution\n\nKubernetes security, Postgres access controls, or data platform security such as Databricks\n\nLeading incident response in a cloud environment\n\nCompliance evidence work for cloud controls: SOC 2 or ISO 27001\n\nExperience as an early security hire at a fast-growing startup\n\nExperience working with data protection requirements in logs and access controls\n\nWhat we offer\nWe offer competitive compensation aligned to the markets where our team members are based. The compensation range for each role is listed on its posting and will depend on the candidate's experience and work location.\n\nComprehensive health and wellness benefits, including medical, dental, vision, and additional support programs.\n\nThe opportunity to work on cutting-edge AI with a small, mission-driven team\n\nA culture that values transparency, trust, and community impact\n\nCome help build the space where anyone can explore and help shape the future of AI.\nArena Intelligence provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, genetics, sexual orientation, gender identity, or gender expression. We are committed to a diverse and inclusive workforce and welcome people from all backgrounds, experiences, perspectives, and abilities.","description_format":"text","description_chars":6594,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","AI Evaluation & Observability"],"lifecycle":[{"event":"open","at":"2026-11-13T08:58:12Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":252500,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":73,"reasons":["conf:1","win:early"],"computed_at":"2026-11-13T10:25:40Z"},"pay":null,"html_url":"https://alion.io/job/arena-software-engineer-staff-cloud-security-engineer","json_url":"https://alion.io/job/arena-software-engineer-staff-cloud-security-engineer.json","meta":{"generated_at":"2026-11-13T10:25:40Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7289,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1017},"rest":"https://alion.io/mcp/rest/get_company?id=1017"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farena-software-engineer-staff-cloud-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farena-software-engineer-staff-cloud-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farena-software-engineer-staff-cloud-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arena-software-engineer-staff-cloud-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farena-software-engineer-staff-cloud-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4228755}},{"tool":"search_jobs","arguments":{"company":"arena.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4228755},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}