Principal Cloud Security Engineer (Product Security)

Location: US-Remote; this is a remote position.

Salary: $159,000–$210,500 per year, plus performance-based incentives and restricted stock units.

Company

hirify.global provides healthcare financial solutions designed to help consumers connect health and wealth, with a focus on health savings accounts.

What you will do

• Lead cloud security posture management across a large multi-subscription estate using CNAPP/CSPM tooling, prioritizing exposure, misconfiguration, and risk remediation.
• Design policy-as-code guardrails, infrastructure-as-code validation, cloud landing-zone security baselines, and account and subscription provisioning controls.
• Build event-driven detection and automated remediation, defining when automation or human review is appropriate.
• Reduce network exposure through WAF rules, tighter security-group controls, API gateways, firewalls, and private connectivity patterns.
• Define IAM strategy across Azure, AWS, and GCP, including federated identity, SSO, least privilege, conditional access, and reduced standing privilege.
• Lead threat modeling, architecture reviews, penetration-test and audit coordination, software supply-chain controls, AI security governance, and technical direction for security engineers.

Requirements

• 12+ years of experience in cloud security, security engineering, application security, or a closely related discipline, including significant experience securing production cloud environments.
• Extensive hands-on experience architecting, building, and operating security controls in production AWS and Azure environments across multi-account and multi-subscription estates.
• Deep CNAPP/CSPM experience, including posture management, exposure and attack-surface management, and risk-based prioritization.
• Advanced policy-as-code and preventive-guardrail experience with SCPs, AWS Config rules, CloudFormation Guard, Azure Policy, and infrastructure-as-code validation in CI/CD.
• Strong knowledge of AWS and Azure security services, including Control Tower, Organizations, Security Hub, GuardDuty, Defender for Cloud, Sentinel, WAF, and firewall services.
• Experience with event-driven automated remediation, cloud network security, security groups, NSGs, WAF, API gateways, and private connectivity.
• Proficiency in Python, PowerShell, and Bash for security automation and tooling.
• Advanced cloud IAM knowledge covering federated identity, SSO, SAML, OAuth 2.0, OIDC, least privilege, and conditional access.
• Application-security expertise covering threat modeling, architectural security reviews, secure code review, OWASP Top 10, CWE Top 25, vulnerability management, SAST, secret scanning, software composition analysis, penetration testing, and software supply-chain security.
• Working knowledge of AI and LLM security risks, model guardrails, MCP, and AI-assisted development tools; ability to communicate complex risks to technical and non-technical audiences and lead across teams without direct authority.

Nice to have

• Experience scaling security capabilities in CI/CD pipelines and developer workflows.
• Experience designing and operating bug bounty or vulnerability disclosure programs.
• Experience in healthcare, financial services, or another highly regulated industry.
• Knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar frameworks.
• AWS Certified Security – Specialty, Microsoft Azure security certifications, CCSP, CISSP, or comparable credentials.

Culture & Benefits

• Full-time employment with medical, dental, and vision coverage.
• HSA contribution and match, dependent-care FSA match, 401(k) match, and uncapped paid time off.
• Paid parental leave, education and tuition assistance, gym and fitness reimbursement, and wellness incentives.
• Performance-based incentives and restricted stock units are part of the total compensation package.
• hirify.global supports an inclusive workplace and provides applicant privacy controls, including the option to opt out of interview transcription and identity-verification analysis.

Hiring process

• Live interviews and assessments must reflect the candidate’s own voice, experience, and thinking; AI assistance is not permitted during these stages unless explicitly approved.
• Candidates may opt out in advance of Microsoft Copilot interview transcription and Pindrop Pulse identity-verification analysis by notifying the Talent Partner.