{"id":3871571,"url":"https://alion.io/job/health-equity-principal-cloud-security-engineer","title":"Principal Cloud Security Engineer","company":{"id":1781288,"name":"Health Equity","domain":"healthequity.com","url":"https://alion.io/company/healthequity-com","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":159000,"max":210500,"currency":"USD","period":"year","gross":null,"usd_annual":210500},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"CWE","optional":false},{"name":"Defense in Depth","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Copilot","optional":true},{"name":"HIPAA","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-11-06T11:49:48Z","employer_posted_date":null,"last_verified_at":"2026-11-06T11:49:48Z","board_verified":false,"closed_at":null,"days_open":2,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":2},"description":"Our MissionOur mission is to SAVE AND IMPROVE LIVES BY EMPOWERING HEALTHCARE CONSUMERS. Come be part of remarkable.\nOverviewHow you can make a difference As a Principal Cloud Security Engineer, Product Security, you provide technical leadership for the security of the cloud environments that host HealthEquity's products and platforms. Reporting to the VP, Head of Product Security, you design the posture management, policy-as-code guardrails, and automated controls that keep misconfigured and overexposed resources out of production across our environments. \nYou combine hands-on cloud engineering with sound architectural judgment. You define cloud security standards and reference architectures, build preventive and detective controls as code, and work with product and platform engineering teams so that secure patterns are the default path rather than a late-stage review. Your application security and threat modeling background keeps those controls tied to how HealthEquity's products are built and how they could be attacked. \nThe standards, guardrails, and automation you establish reduce public attack surface, shorten the time from detection to remediation, and let engineering teams deliver securely with less manual effort, in support of HealthEquity's responsibility to protect member data. \nWhat you’ll be doingLead the architecture and ongoing evolution of cloud security posture management across a large multi-subscription estate, using CNAPP/CSPM tooling to surface public exposure, misconfiguration, and risk, and driving prioritized remediation with product and platform teams. \nDesign and build policy-as-code preventive guardrails, including service control policies, Azure Policy, and infrastructure-as-code validation in CI/CD, that block non-compliant infrastructure before it reaches production while applying defense-in-depth. \nOwn the security architecture for cloud landing zones and account and subscription provisioning, so that newly created environments inherit security baselines, guardrails, and logging by default. \nBuild event-driven auto-remediation that enforces security and compliance baselines at scale, and define when automated action is appropriate and when human review is required. \nLead network exposure reduction for customer-facing applications, including web application firewall rule management, tighter security group and network security group ingress, and a move toward private connectivity. \nDefine and evolve the IAM strategy for Azure, AWS, and GCP including federated identity, standardized SSO, least privilege, conditional access, and reduction of standing privilege. \nLead threat modeling and architecture reviews for high-risk, cloud-hosted products and migrations, and scope and coordinate third-party penetration tests and audits, translating findings into prioritized remediation plans for engineering and executive stakeholders. \nPartner with Application Security and Vulnerability Management to build code scanning, secret detection, dependency analysis, and software supply chain controls into developer workflows and release gates, and support external researcher and bug bounty programs through scope, triage, and remediation SLAs. \nEstablish security guardrails, governance requirements, and secure-adoption policy for AI services and AI-enabled development tooling in cloud environments, including managed model guardrails and Model Context Protocol (MCP) security. \nSet technical direction, identify systemic risks, recommend strategic improvements, and mentor and guide security engineers while driving the evolution of team tools, practices, standards, and automation capabilities. \nWhat you will need to be successfulThis role requires deep, hands-on experience securing production cloud environments at enterprise scale, combined with the architectural judgment that comes from an application security background and the ability to provide technical leadership across teams. \nCloud Security Engineering ExpertiseExtensive experience architecting, building, and operating cloud security controls in production AWS and Azure environments, including multi-account and multi-subscription estates. \nDeep experience with CNAPP/CSPM platforms for posture management, exposure and attack-surface management, and risk-based prioritization of findings. \nAdvanced proficiency with policy-as-code and preventive guardrails, such as SCPs, AWS Config rules, CloudFormation Guard, Azure Policy, and security validation of infrastructure-as-code (CloudFormation, CDK) within CI/CD pipelines. \nStrong working knowledge of AWS and Azure native security services, including Control Tower, Organizations, Security Hub, GuardDuty, Defender for Cloud, Sentinel, and cloud WAF and firewall services. \nExperience designing and operating event-driven automated remediation and detection that enforces security baselines across a cloud estate. \nStrong understanding of cloud network security, including security groups and NSGs, WAF, API gateways, and private connectivity patterns. \nProficiency in Python, PowerShell, and Bash for security automation and tooling. \nIdentity, Application & AI Security ExpertiseAdvanced knowledge of cloud identity and access management, including federated identity, SSO, SAML, OAuth 2.0, OIDC, least privilege, and conditional access. \nStrong foundation in application security, including threat modeling (STRIDE, attack trees), architectural security reviews, secure code review, OWASP Top 10, and CWE Top 25. \nExperience building vulnerability management and software supply chain programs, including SAST, secret scanning, software composition analysis, and triage and prioritization workflows that give developers actionable feedback. \nWorking knowledge of the security risks of AI and LLM technologies, including model guardrails, MCP, and AI-assisted development tools, and the controls needed to adopt them safely. \nHands-on understanding of penetration testing and offensive security findings sufficient to scope engagements, evaluate results, and drive remediation. \nExperience & Background12+ years of experience in cloud security, security engineering, application security, or a closely related discipline, including significant time securing production cloud environments. \nDemonstrated experience architecting, delivering, and operating security solutions with broad organizational impact across a large cloud estate and many development teams. \nExperience serving as a technical lead and mentoring engineers, and leading initiatives across cross-functional engineering and security teams without relying on direct authority. \nAbility to influence technical direction and clearly explain complex risks, tradeoffs, and findings to technical and non-technical audiences, including senior leaders. \nExceptional judgment in balancing security requirements with engineering practicality, business needs, and long-term platform strategy. \nPreferred QualificationsExperience defining and scaling security capabilities within CI/CD pipelines and developer workflows. \nExperience designing and operating a bug bounty or vulnerability disclosure program. \nExperience in healthcare, financial services, or another highly regulated industry. \nStrong working knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar regulatory and security frameworks. \nRelevant industry certifications such as AWS Certified Security - Specialty, Microsoft Azure security certifications, CCSP, CISSP, or comparable credentials. \nThis is a remote position.Salary Range$159000.00 To $210500.00 / yearBenefits & PerksThe actual compensation offer is determined based on job-related knowledge, education, skills, experience, and work location. This position will be eligible for performance-based incentives and restricted stock units as part of the total compensation package, in addition to a full range of benefits including: \nMedical, dental, and vision \nHSA contribution and match \nDependent care FSA match \nUncapped paid time off \nPaid parental leave \n401(k) match \nPersonal and healthcare financial literacy programs \nOngoing education & tuition assistance \nGym and fitness reimbursement \nWellness program incentives \nWhy work with HealthEquity HealthEquity has a vision that by 2030 we will make HSAs as wide-spread and popular as retirement accounts. We are passionate about providing a solution that allows American families to connect health and wealth. Join us and discover a work experience where the person is valued more than the position. Click here to learn more. \nYou belong at HealthEquity!HealthEquity, Inc. is an equal opportunity employer, and we are committed to being an employer where no matter your background or identity – you feel welcome and included. We ensure equal opportunity for all applicants and employees without regard to race, age, color, religion, sex, sexual orientation, gender identity, national origin, status as a qualified individual with a disability, veteran status, or other legally protected characteristics. HealthEquity is a drug-free workplace. For more information about our EEO policy, or about HealthEquity’s applicant disability accommodation, drug-free-workplace, background check, and E-Verify policies, please visit our Careers page.\nHealthEquity uses Microsoft Copilot to transcribe screening interviews between candidates and their direct Talent Partner for note taking and interview summaries. By scheduling a screening interview with us, you consent to Microsoft Copilot’s AI technology recording and transcribing your interview with your Talent Partner. This information will be reviewed for accuracy and then used by HealthEquity to summarize the interview, ensure accuracy, and facilitate our hiring process. We take privacy seriously. You have the option to opt out. If you wish to opt out of this Microsoft Copilot transcription, please notify your Talent Partner in advance of the interview. If we do not receive an opt-out request from you, we will assume that you consent to the use of Microsoft Copilot.\nHealthEquity uses Pindrop Pulse during certain interviews to support identity verification, interview security, and fraud prevention. By scheduling and participating in an interview where Pindrop Pulse is enabled, you acknowledge that Pindrop's technology may analyze information such as voice, video, device, network, and location-related signals to identify potential impersonation, deepfake activity, and other security risks. This information may be reviewed by HealthEquity's Talent Acquisition and Security teams to support a secure hiring process. All alerts and risk indicators are reviewed by trained personnel, and HealthEquity does not make hiring decisions based solely on automated analysis. We take privacy seriously. You have the option to opt out of Pindrop analysis. If you wish to opt out, please notify your Talent Partner in advance of the interview. If we do not receive an opt-out request from you before the interview, we will assume that you consent to HealthEquity's use of Pindrop Pulse for security verification purposes during the hiring process. \nAt HealthEquity, our goal is to save and improve lives by empowering healthcare consumers. This shared purpose inspires everything we do, including how we approach hiring. Our process is designed to get to know the real you: your skills, experiences, and potential to make a difference. We value honesty, originality, and the courage to do the right thing, even when it is not the easiest path. Showing up as your authentic self reflects these values and helps us build something truly remarkable together.\nAs AI is becoming a common tool throughout the application process, we want to be clear about its appropriate use at HealthEquity. Using AI to support resume writing, research, or interview preparation is perfectly acceptable, provided the content is accurate and genuinely represents your qualifications and skills. For other key parts of our interview pro...","description_format":"text","description_chars":12935,"description_truncated":true,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Parental leave","Restricted stock units"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security"],"lifecycle":[{"event":"open","at":"2026-11-06T14:28:45Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":29,"reasons":["seen:1","win:early"],"computed_at":"2026-11-08T05:47:12Z"},"pay":{"stated_usd_annual":210500,"is_top_pay":true},"html_url":"https://alion.io/job/health-equity-principal-cloud-security-engineer","json_url":"https://alion.io/job/health-equity-principal-cloud-security-engineer.json","meta":{"generated_at":"2026-11-08T15:44:22Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"assistant_verified","counted_by":"address","units_charged":1,"used_today":5382,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1781288},"rest":"https://alion.io/mcp/rest/get_company?id=1781288"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhealth-equity-principal-cloud-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhealth-equity-principal-cloud-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhealth-equity-principal-cloud-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/health-equity-principal-cloud-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhealth-equity-principal-cloud-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3871571}},{"tool":"search_jobs","arguments":{"company":"healthequity.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3871571},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}