Software Engineer - Staff Cloud Security Engineer

This Staff-level cloud security engineering role is focused on designing and building practical controls to protect Arena Intelligence’s cloud infrastructure. The position sits onsite in the San Francisco Bay Area and reports to the Head of Security.

Role Focus

You will build protections across workload identity, machine credentials, access boundaries, cloud detections and alerts, and infrastructure-as-code security checks. The goal is to make secure cloud operations repeatable, observable, and easier to get right in day-to-day engineering work.

Key Responsibilities

• Design a cloud identity model for workloads, including least-privilege IAM, workload identity federation, and short-lived credentials.
• Own machine secrets and rotation end to end, including assigning an owner, storing secrets in a central secret manager, and maintaining a rotation path that has been run.
• Define network and access rules for environments and services, including outbound connection limits, separation between environments, and boundaries around agent runtimes.
• Build cloud security detections and alerts for high-risk changes to cloud infrastructure and build systems, including response steps colleagues can follow without your direct involvement.
• Embed cloud security checks into infrastructure code and build pipelines so the secure workflow is the default path.
• Secure machine credentials and permissions used by source control, build pipelines, and cloud deployments.
• Assess technical access requested by vendors and managed platforms before onboarding.
• Lead technical response to cloud infrastructure security events, coordinating with impacted teams through recovery.
• Maintain visibility into cloud security posture for engineering and leadership, and continuously improve it.
• Participate in the security on-call rotation.

Required Qualifications

• 6+ years in security or infrastructure engineering, with at least 3 years focused on cloud security in production.
• Deep, hands-on experience securing AWS, GCP, and Cloudflare.
• Demonstrated ownership of cloud security initiatives, including making design decisions for IAM and secrets and defending those approaches.
• Strong depth in workload identity, including OIDC, workload identity federation, IAM design, and secret managers.
• Rotation experience you have actually run, including rotating a production database or API credential without an outage.
• Detection and response experience in cloud environments, including writing detections, being paged, and investigating a real event using cloud audit logs.
• Comfort with Terraform or a similar infrastructure-as-code tool, and experience in at least one automation language such as Python, Go, or TypeScript.
• Experience securing build pipelines and CI/CD, including GitHub Actions and deployment credentials.
• Hands-on use of AI tooling in your own work, including building, scripting, and investigating tasks, and understanding where it fits in a security workflow versus where it does not.
• Judgment to distinguish real exposure from theoretical risk.
• Ability to improve existing systems and documentation while keeping work moving.

Technologies

• AWS, GCP, Cloudflare
• OIDC
• Terraform
• Python, Go, TypeScript
• GitHub Actions
• CI/CD

Location and Work Mode

San Francisco Bay Area, CA (onsite). The role is hands-on onsite in San Francisco and reports to the Head of Security.

Benefits

• Comprehensive health and wellness benefits, including medical, dental, vision, and additional support programs.
• Competitive compensation aligned to the markets where team members are based.

Bonus Points

• Securing serverless platforms such as Vercel.
• Securing infrastructure for AI agent runtimes or sandboxed code execution.
• Kubernetes security, Postgres access controls, or data platform security such as Databricks.
• Leading incident response in a cloud environment.
• Compliance evidence work for cloud controls such as SOC 2 or ISO 27001.
• Experience as an early security hire at a fast-growing startup.
• Experience working with data protection requirements in logs and access controls.