Cloud Segmentation Engineer
First seen by Alion on Oct 6, 2026.
About ColorTokens
At ColorTokens, we keep enterprises running while they are under attack. Breaches happen — our Xshield™ platform contains them, stopping ransomware and advanced malware from spreading, so that one compromised machine never becomes a compromised business.
AI has changed the odds. Attackers now probe systems, chain weaknesses together and move across a network at machine speed — and more and more of the identities doing it are not human at all. Building the defense against that is why Forrester named ColorTokens a Leader in The Forrester Wave™: Microsegmentation Solutions, Q3 2026 — one of only four Leaders, with top marks in nine categories.
Join us in transforming cybersecurity. Learn more at www.colortokens.com.
Our culture
We value customer focus, innovation, collaboration and informed decision-making — and we back it with real autonomy, so you own your initiatives and drive them. Self-starters will enjoy the reward of solving hard problems that protect organizations that matter.
The Role
You will build the part of Xshield that protects the public cloud. Instead of installing software on every workload, we connect straight to a customer's AWS, Azure or GCP environment, map everything running in it and how it all talks, then use the cloud's own controls to allow only the traffic that should exist. When an attack is detected, we isolate the affected resources in seconds — without taking the rest of the business offline.
It is a small, senior team shipping to some of the largest cloud estates in the world, and you will own what you build from design through to production.
What You Will Work On
- Discovering a customer's entire cloud footprint through provider APIs alone — no agents, no installs — across AWS, Azure and GCP.
- Turning billions of raw cloud network records into a clear, trustworthy picture of which workloads actually talk to each other.
- Translating security policy into the cloud's own enforcement controls and applying it safely across live production accounts.
- One-click isolation of a compromised workload during a live incident — fast enough to matter, precise enough not to break the business.
- Extending that protection to machine identities and their permissions, so a hijacked workload or a rogue AI agent cannot use its access to spread.
Skills & Requirements
- Strong programming skills in Go or Python, with production ownership of something you built.
- Solid hands-on experience with at least one major cloud (AWS, Azure or GCP), especially its networking and identity/access model.
- Comfort with distributed, event-driven systems and the messy realities they bring: retries, partial failures, eventual consistency.
- Sound data modelling instincts across both NoSQL and relational databases.
- Infrastructure as Code (Terraform, CDK or Bicep) and CI/CD pipelines you have actually shipped through.
- Strong networking fundamentals — routing, subnetting, NAT, DNS, and how firewall rules really behave in practice.
- A genuine testing habit and clear written communication; design decisions here are argued in writing.
- Nice to have: a security background (Zero Trust, microsegmentation, CSPM/CNAPP), multi-cloud breadth, Kubernetes networking, or experience putting AI coding agents to work.
Years of Experience
- 2 to 10 years of professional experience. We are hiring at several levels, from engineers who will own well-scoped features to senior engineers who will own an entire cloud provider end to end.
- Must have shipped and run cloud software in production, with real accountability for what happened after it went live.
What Success Looks Like (First 6–9 Months)
- You own a meaningful piece of the product end to end and ship to it with confidence.
- Protection applies cleanly and predictably in your area, and the same problems stop coming back.
- You track down production issues across services and cloud providers, and turn each one into a lasting fix.
- You are the person others check with before changing your area, and you are trusted with the design call on a new capability or a new cloud.