Cloud Security Engineer

Stratesys; Ávila; Presencial; EUR 52.000 - 80.000; Jornada completa

Descripción de la vacante

Roche is seeking a Cloud Security Engineer to architect and operate CWPP across AWS, Azure, and GCP, with a focus on container security and cloud-native controls.

You will drive security in CI/CD pipelines, implement runtime protection for container workloads, and develop automated remediation using cloud APIs and serverless functions. English fluency required for global collaboration.

Formación

• Bachelor's degree or equivalent practical experience in CS, software engineering or cybersecurity.
• 3+ years securing public cloud workloads with a strong shared responsibility model.
• Hands-on with Docker, Kubernetes, and container orchestration to secure pods and manage network policies.
• Proven experience deploying and tuning CWPP/CNAPP platforms in multi-cloud environments.
• Strong cloud networking and IAM fundamentals, with emphasis on least-privilege access.
• Excellent written and spoken English (C1 or above).

Responsabilidades

• Cloud Workload Protection Platform deployment, management across AWS, Azure, and GCP.
• Container and Kubernetes security, runtime defense, vulnerability scanning, and hardening.
• Extend security tooling for CI/CD, scanning images, registries, and IaC templates.
• Automated remediation using serverless functions and cloud APIs.
• Collaborate with DevSecOps to embed security into development pipelines.

Conocimientos

CWPP / CNAPP

Docker

Kubernetes

DevSecOps

Cloud security

Educación

Bachelor's degree in Computer Science or related

Herramientas

AWS

Azure

GCP

EKS

AKS

GKE

Descripción del empleo

Roche – Cloud Security Engineer specializing in Cloud Workload Protection

Job Responsibilities

• Cloud Workload Protection (CWPP): Architect, deploy, and manage Cloud Workload Protection Platforms across multi-cloud environments (AWS, Azure, and/or GCP).
• Container & Kubernetes Security: Implement runtime defense, vulnerability scanning, and configuration hardening for containerized applications and orchestration platforms (EKS, AKS, GKE).
• Extending Core Services to the Cloud: Adapt our existing strategies for EDR and Application Control to function effectively in ephemeral, cloud-native workloads without degrading performance.
• DevSecOps Integration: Embed security controls directly into CI/CD pipelines (Shift-Left), ensuring images, registries, and Infrastructure as Code (IaC) templates are scanned and secured before deployment.
• Automated Remediation: Develop automated response playbooks for cloud misconfigurations and workload alerts using serverless functions and native cloud APIs.

Qualifications

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity, or equivalent practical experience.
• 3+ years of dedicated experience securing public cloud workloads, with a strong understanding of the shared responsibility model.
• Deep technical knowledge of Docker, Kubernetes, and container orchestration; ability to secure a pod, restrict container privileges, and manage network policies.
• Proven, hands-on experience deploying and tuning cloud security platforms (CWPP / CNAPP).
• Strong grasp of cloud-native networking (VPCs, Security Groups) and Identity and Access Management (least-privilege roles, service accounts).
• Proficiency in written and spoken English (C1 or above).