Specialist Cloud Security

Canadian Pacific Railway Limited; Calgary; On-site; CAD 120,000 - 180,000; Full time

Benefits offered by this job

Flexible benefits

Pension plan

Employee share purchase plan

Performance incentive

Annual fitness subsidy

Job summary

Canadian Pacific Railway Limited is seeking a Cloud Security Engineer to protect and advance our cloud platforms across AWS and Azure. You will implement security controls, partner with security and engineering teams, and drive secure, scalable cloud solutions in a fast-paced railway environment.

The role emphasizes IaC, automation, and risk remediation, with responsibilities to design secure infrastructure, manage identity, encryption, and logging, and help govern cloud configurations while

Qualifications

• 6+ years of experience in cloud infrastructure, cloud engineering, cybersecurity, or related technical roles.
• 4+ years of hands-on experience designing, deploying, and operating production workloads in AWS.
• Proven experience with AWS monitoring, governance, and security services.
• Experience implementing secure cloud networking, encryption, secrets management, and IaC solutions.
• Willingness to travel within Canada and the United States as required.

Responsibilities

• Develop and maintain IaC solutions to standardize and automate security controls in cloud environments.
• Implement security best practices including IAM, encryption, network segmentation, logging, and incident response.
• Collaborate with Enterprise Security, Enterprise Architecture, and product teams to secure cloud environments.
• Design, implement, and maintain secure cloud infrastructure across AWS and Azure with scalability and reliability.

Skills

Cloud infrastructure

Cloud security

AWS

Terraform

IaC

Networking security

Travel

Education

Information Technology

Cybersecurity

Computer Science

Tools

CloudWatch

CloudTrail

Config

GuardDuty

AWS IAM

API Gateway

EventBridge

SNS

SQS

Terraform

CloudFormation

Azure VNets

Azure NSGs

KMS

Secrets Manager

Azure Key Vault

Job description

Join CPKC, North America’s first transnational railroad connecting U.S., Canada, and Mexico, where your career drives progress and safety is paramount. We connect communities, fuel economic growth, and provide meaningful work in a culture that values diversity, accountability, and pride. With opportunities for training, development, and advancement, you’re not just building a career—you’re part of something bigger. Together, we move goods, connect people, and create lasting change. Your future starts here.

PURPOSE OF THE POSITION:

As a Cloud Security Engineer, you will play a key role in protecting and advancing our cloud platforms by implementing and enhancing security controls across AWS and Azure environments. You will collaborate closely with cloud engineers, architects, and business stakeholders to identify and remediate security risks, support the design of secure and scalable cloud solutions, and help drive security best practices throughout the organization. This is an exciting opportunity to work with leading cloud technologies, security automation, and Infrastructure as Code (IaC) while making a direct impact on the security, reliability, and future growth of our enterprise cloud environment.

POSITION ACCOUNTABILITIES:

• Develop and maintain existing Infrastructure as Code (IaC) solutions to standardize, automate, version-control, and reliably provision security controls in our cloud environments
• Implement security best practices, including identity and access management, encryption, network segmentation, secrets management, logging, threat detection, and incident response controls
• Partner with Enterprise Security, Enterprise Architecture, and product teams to ensure cloud environments are secured
• Design, implement, and maintain secure cloud infrastructure solutions across AWS and Azure environments, ensuring scalability, reliability, and operational excellence

POSITION REQUIREMENTS:

• Post-secondary degree or diploma in Information Technology, Cybersecurity, Computer Science, or a related field, or an equivalent combination of education and industry experience
• 6+ years of experience in cloud infrastructure, cloud engineering, cybersecurity, or related technical roles
• 4+ years of hands‑on experience designing, deploying, and operating production workloads in AWS
• Demonstrated experience with AWS monitoring, governance, and security services, including Amazon CloudWatch, CloudTrail, AWS Config, GuardDuty, AWS Organizations, AWS IAM, API Gateway, EventBridge, SNS, and SQS
• Proven experience implementing secure cloud networking, encryption, secrets management, and Infrastructure as Code (IaC) solutions using Amazon VPC, Security Groups, Route 53, Transit Gateway, Azure VNets, Azure Network Security Groups, AWS KMS, AWS Secrets Manager, Azure Key Vault, Terraform, and AWS CloudFormation
• Valid passport with the ability to travel within Canada and the United States without restrictions, as required by the role

WHAT CPKC HAS TO OFFER:

• Flexible and competitive benefits package
• Competitive company pension and/or retirement plans
• Employee share purchase plan
• Performance incentive plan
• Annual fitness subsidy

PRE-EMPLOYMENT REQUIREMENTS:

• Criminal history check
• Education verification
• Professional references

BECOMING A RAILROADER:

As an employee with a North American presence, the possibility does exist that the location of your position may be changed based on organizational requirements.

Management Conductor Program

Becoming a qualified conductor or locomotive engineer is the single best way for a management employee to learn the business at CPKC. You may be required to obtain a certification or to maintain your current certification/qualification as a conductor or locomotive engineer.

CULTURE OF INCLUSION:

For our U.S. applicants, CPKC is an equal opportunity/affirmative action employer, inclusive of protected veterans and individuals with disabilities. For Canadian applicants CPKC is an employment equity employer committed to the principles of employment equity and inclusion. We encourage all qualified candidates to apply including: women, Black, Indigenous, People of Color (BIPOC), members of the LGBTQ+ community and people with disabilities. Accommodations for the job application process can be provided, as appropriate, upon request. All applicant information will be managed in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA).