Cloud Security Engineer

Vitol; Genf; On-site; CHF 120,000 - 190,000; Full time

Job summary

Vitol is seeking a Cloud Security Engineer to secure its AWS and GCP environments and the workloads that run on them across global trading and physical operations. You will implement controls, CSPM, CWPP, CIEM, and IAM safeguards while collaborating with CISO, engineering, and infrastructure teams.

The role offers ownership of security platforms, dashboards, policy as code, and secure DevSecOps practices, with a focus on fast delivery and measurable risk reduction across our 40+ offices.

Qualifications

• Bachelor's or higher in Computer Science, Engineering, or related field.
• 5+ years hands-on AWS/GCP security experience.
• Experience with Wiz, CrowdStrike Cloud Security, or Palo Alto Prisma Cloud.
• Strong knowledge of IAM, encryption, logging, and network controls.
• Terraform and securing CI/CD pipelines experience.
• Fluent English; French an advantage.

Responsibilities

• Design, deploy, and operate security controls across AWS and GCP.
• Engineer and operate cloud security platforms like Wiz and CrowdStrike.
• Define baselines for accounts and projects, IAM, encryption, logging.
• Secure container workloads on EKS and GKE.
• Embed security in CI/CD through infrastructure‑as‑code, SAST, secret detection.
• Develop dashboards for cloud security posture and KPIs.

Skills

Cloud security

AWS & GCP security

Kubernetes security

CSPM/CWPP

Python scripting

Terraform

Education

Technical degree in CS/Engineering

Tools

Wiz

CrowdStrike Cloud Security

Palo Alto Prisma Cloud/Cortex

Terraform

Job description

Company Description

Vitol is a leader in the energy sector with a presence across the spectrum: from oil through to power, renewables and carbon. From 40 offices worldwide, we seek to add value across the energy supply chain, including deploying our scale and market understanding to help facilitate the energy transition. To date, we have committed over $2 billion of capital to renewable projects, and are identifying and developing low‑carbon opportunities around the world.

Our people are our business. Talent is precious to us and we create an environment in which individuals can reach their full potential, unhindered by hierarchy. Our team comprises more than 65 nationalities and we are committed to developing and sustaining a diverse work force. Learn more about us here.

Job Description

Vitol is seeking a Cloud Security Engineer to join its Technology department. The role is accountable for securing Vitol's AWS and Google Cloud (GCP) environments, and the workloads that run on them, across our worldwide trading and physical operations.

The Cloud Security Engineer will build and run the controls that let engineering teams deliver in the cloud quickly and safely, using platforms such as Wiz, CrowdStrike, Palo Alto Networks and other CSPM. The role is the practical link between security requirements and the way cloud services are built and operated.

The Cloud Security Engineer will work closely with the CISO organization, Developer Community Enablement, product engineering and local infrastructure teams globally.

Key areas of responsibility for the Cloud Security Engineer include:

• Cloud Security Controls: Design, deploy, and operate security controls across AWS and GCP, covering posture management (CSPM), workload protection (CWPP), identity and entitlements (CIEM), and network security.
• Security Platform Engineering: Engineer and operate cloud security platforms such as Wiz, CrowdStrike Cloud Security, and Palo Alto Networks: onboard accounts and projects, tune policies, and route findings into existing workflows.
• Baselines & Guardrails: Define and maintain secure baselines for AWS accounts and GCP projects, including organization policies, IAM, encryption, logging, and network segmentation.
• Containers & Kubernetes: Secure container workloads on EKS and GKE, from image build through to runtime.
• Data Protection: Protect sensitive data in the cloud and reduce the risk of data exfiltration.
• Vulnerability Management & Incident Response: Prioritize cloud vulnerabilities and misconfigurations by risk, drive remediation with the owning teams, and support the Cyber Security & Assurance teams in the investigation of and response to cloud security incidents.
• DevSecOps: Embed security checks in CI/CD pipelines (infrastructure‑as‑code scanning, SAST, secret detection, and image scanning), maintain policy as code, and review Terraform modules for security.
• Automation: Automate remediation, evidence collection, and reporting through scripting and APIs.
• Governance & Guidance: Build dashboards and KPIs on cloud security posture, present them in governance forums, and give engineering teams practical guidance on implementing controls.

Qualifications

• Education: Undergraduate or postgraduate degree in a technical discipline (Computer Science, Engineering, Information Security, or a related field), or equivalent experience.
• Cloud Security Experience: 5+ years of hands‑on experience securing workloads in AWS and GCP, with depth in at least one and working knowledge of the other.
• Security Platforms: Hands‑on experience with at least one cloud‑native application protection platform, such as Wiz, CrowdStrike Cloud Security, or Palo Alto Networks Prisma Cloud / Cortex Cloud.
• Native Cloud Controls: Strong knowledge of AWS and GCP security controls, including IAM, key management, organization‑level policies, logging, and network controls.
• Infrastructure as Code & CI/CD: Experience with Terraform and with securing CI/CD pipelines.
• Scripting & Automation: Proficiency in Python or a similar language.
• Containers & Application Security: Understanding of container and Kubernetes security, and of application security fundamentals including the OWASP Top 10.
• Data Protection: Experience protecting sensitive data and mitigating data exfiltration risk.
• Certifications: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP or vendor certifications from Wiz, CrowdStrike, or Palo Alto Networks are an advantage.
• Frameworks & Industry: Working knowledge of CIS Benchmarks, NIST, and ISO 27001, and familiarity with commodity trading or financial services environments, are an advantage.
• Languages: Fluent English required and good knowledge of French an advantage

Additional Information

Soft Skills that will help you stand out

• Autonomous & Proactive: Understands functional and technical requirements, spots gaps, and proposes improvements without waiting to be asked.
• Clear Communicator: Explains technical risk in business terms to engineers and non‑technical stakeholders alike.
• Highly Collaborative: Builds trust with engineering teams and treats security as something that enables delivery.
• Pragmatic & Outcome‑Oriented: Prioritizes by risk and focuses on fixes that measurably reduce exposure.
• Decisive & Action‑Oriented: Comfortable setting priorities and delivering at pace in a flat, high‑ownership culture.
• Intellectually Curious: Keeps up with new cloud services and the threats that come with them.

What We Offer

• Scale and Complexity: The opportunity to secure demanding, high‑stakes cloud workloads across 40+ offices and mission‑critical trading systems.
• Modern Security Stack: Hands‑on work with leading cloud security platforms across AWS and GCP.
• Real Ownership: Direct influence on how cloud security is designed and run at Vitol, with room to shape standards and tooling.
• Flat, Meritocratic Culture: A non‑hierarchical environment where good ideas win on merit, decisions are made rapidly, and bureaucracy is strictly minimized.
• Global Footprint: Work with diverse, highly talented technology and business colleagues across Vitol's global network in Geneva, London, Houston, Singapore, and beyond.