{"id":2751720,"url":"https://alion.io/job/the-vanguard-group-lead-cloud-security-engineer","title":"Lead Cloud Security Engineer","company":{"id":253,"name":"The Vanguard Group","domain":"vanguard.com","url":"https://alion.io/company/vanguard","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":101,"ghost_share":0.059,"stale_share":0.386,"repost_share":0.198,"time_to_fill_p50_days":24,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Malvern, United States","Charlotte, United States","Dallas, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":111000,"max_usd":230000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":373},"experience_years_min":7,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon CloudWatch","optional":false},{"name":"Amazon EventBridge","optional":false},{"name":"Amazon S3","optional":false},{"name":"API Gateway","optional":false},{"name":"AWS","optional":false},{"name":"AWS Lambda","optional":false},{"name":"AWS Step Functions","optional":false},{"name":"Bamboo","optional":false},{"name":"Boto3","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"IAM","optional":false},{"name":"Python","optional":false},{"name":"Terraform","optional":false},{"name":"Azure","optional":true},{"name":"ETL/ELT","optional":true},{"name":"GCP","optional":true},{"name":"Grafana","optional":true},{"name":"ITSM","optional":true},{"name":"Least Privilege","optional":true},{"name":"Power BI","optional":true},{"name":"PowerShell","optional":true},{"name":"pySpark","optional":true},{"name":"Spark","optional":true},{"name":"Splunk","optional":true},{"name":"SQL","optional":true},{"name":"Tableau","optional":true},{"name":"Wiz","optional":true}],"status":"live","first_seen_at":"2026-10-16T00:00:00Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-17T05:12:31Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"The stack you'll work with:\nCore - Hands-on day one\nAWS IAM - roles, policies, trust and resource-policy patterns, permission boundaries, SCPs.\nCloudFormation (JSON/YAML) - heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits).\nPython for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3).\nCI/CD pipelines (GitHub Actions, Bamboo, or similar) for building, testing, and shipping controls.\nCore AWS at org scale - Organizations, IAM Identity Center, and services such as Lambda, EventBridge, Step Functions, S3, API Gateway, and CloudWatch.\nNice to have - or you'll pick up fast\nSecurity-native AWS - Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS.\nCSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana).\nData skills (SQL and JSON, ETL, Tableau/Power BI).\nMulti-cloud exposure (GCP, Azure, OCI).\nPowerShell, PySpark, and AI-assisted tooling.\nCore Responsibilities:\nTechnical Leadership\nLead technical design reviews and own the standards for how controls are built, tested, and shipped - raising the bar on code quality, systems thinking, and operational readiness.\nTrain, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff.\nInfluence engineering patterns and best practices across teams - driving technical direction beyond your immediate team, without direct authority.\nSolution Design & Delivery\nDesign enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on - designing for auditability, fault tolerance, and graceful degradation when upstream systems change.\nEvaluate and select the tooling, frameworks, and integration patterns the broader team adopts - owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM).\nMove fluidly between design and hands-on build; stay close to the code.\nAutomation & Infrastructure as Code\nBuild preventive and detective controls as code - author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (CloudFormation and/or Terraform) and policy-as-code (Rego/OPA).\nEmbed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control.\nAutomate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate).\nSecurity Engineering & Strategy\nEngineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale.\nOperationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls.\nTranslate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness.\nSupport privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed.\nQualifications:\nMinimum of seven years related work experience, with four or more years in cloud or security engineering preferred.\nStrong hands-on engineering - writes and ships production-grade code (Python or equivalent - production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with CloudFormation day to day (Terraform a plus).\nDeep cloud expertise - hands-on experience across at least one of AWS, GCP, or Azure (AWS strongly preferred), at the level of org-wide account structures, landing zones, and cross-account security patterns at scale.\nTechnical leadership & influence - a track record of leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction across teams without direct authority.\nSecurity judgment - reasons about trust boundaries, least privilege, and blast radius; can threat-model what goes wrong when access is too broad.\nFamiliarity with AWS IAM policy mechanics - inline, customer-managed, permission boundaries, SCPs, RCPs, and resource/identity policies - is a plus; depth here is learnable on the job.\nExperience working directly with engineering teams on policy-as-code, CI/CD integrations, code repositories and pipelines (GitHub or similar), and cloud security tooling.\nExperience operating in regulated or audit-driven environments.\nRelevant certification (e.g. AWS Security Specialty or a Professional-level AWS certification) is a plus, not required.\nUndergraduate degree in a related field or the equivalent combination of training and experience.\nWhy This Role Matters:\nThis role is central to reducing enterprise risk, enabling secure cloud adoption, and operationalizing cloud security strategy through engineering. Success is measured by technical coverage, control effectiveness, and platform trust. You will directly shape how cloud security controls are designed, built, and adopted across Vanguard.\nSpecial Factors\nSponsorship\nVanguard is not offering visa sponsorship for this position.About Vanguard\nAt Vanguard, we don't just have a mission-we're on a mission.\nTo work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.\nHow We Work\nVanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.","description_format":"text","description_chars":6106,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Hybrid work"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","Wealth Management & Financial Advisors","Asset Management & Funds","Online Brokerage & Trading Platforms"],"lifecycle":[{"event":"open","at":"2026-10-17T00:11:36Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 228 · green card filings: 155","filings_12m":228,"filings_prev_12m":301,"green_card_filings_12m":155,"median_offered_wage_usd":148453,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":28}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":24,"reasons":["conf:0","velocity","win:early","comp:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/the-vanguard-group-lead-cloud-security-engineer","json_url":"https://alion.io/job/the-vanguard-group-lead-cloud-security-engineer.json","meta":{"generated_at":"2026-10-17T16:22:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22517,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":253},"rest":"https://alion.io/mcp/rest/get_company?id=253"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fthe-vanguard-group-lead-cloud-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fthe-vanguard-group-lead-cloud-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fthe-vanguard-group-lead-cloud-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/the-vanguard-group-lead-cloud-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fthe-vanguard-group-lead-cloud-security-engineer"}]}