Cloud Security Engineer: Policy-as-Code & Multi-Cloud Guardrails

Happyrobot; Madrid, Barcelona; On-site; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Healthcare

Dental coverage

Vision coverage

Equity

Job summary

HappyRobot in Madrid is seeking a Cloud Security Engineer to own cloud posture across AWS, Azure, and GCP, ensuring security baseline and remediation SLAs in a fast-paced enterprise environment. The role requires 4–6 years of cloud security experience, CNAPP/CSPM proficiency (Wiz preferred), Terraform with policy-as-code in CI/CD, and strong Kubernetes security skills.

Scripting in Python or Go and English at B2+ are required.

Qualifications

• 4–6 years in cloud security or platform/infrastructure security.
• Expert depth in at least one major cloud provider (AWS, Azure, or GCP).
• Hands-on CNAPP/CSPM experience including triage and remediation with engineering teams.
• Terraform in production with policy-as-code in CI/CD.
• Kubernetes security fundamentals: RBAC, admission controls, and image scanning.
• Scripting in Python or Go.
• English B2+ (professional working proficiency).

Responsibilities

• Own the CNAPP end-to-end, triage findings by exploitability and drive remediation to SLA.
• Design and ship policy-as-code gates in Terraform pipelines using OPA/Rego, Checkov, tfsec.
• Define and enforce a consistent security baseline across AWS, Azure, and GCP.
• Harden Kubernetes and containers across EKS, AKS, and GKE with RBAC and image scanning.
• Lead remediation with engineers without direct authority and track SLAs.
• Grow shift-left guardrails to increase Terraform-managed infra with checks.

Skills

Cloud security

CNAPP/CSPM

Terraform

Kubernetes security

Python/Go scripting

English communication

Tools

Wiz CNAPP/CSPM

OPA/Rego

Checkov

tfsec

Terraform CI/CD

Kubernetes security tooling

Job description

HappyRobot in Madrid is seeking a Cloud Security Engineer to own cloud posture across AWS, Azure, and GCP, ensuring security baseline and remediation SLAs in a fast-paced enterprise environment. The role requires 4–6 years of cloud security experience, CNAPP/CSPM proficiency (Wiz preferred), Terraform with policy-as-code in CI/CD, and strong Kubernetes security skills.

Scripting in Python or Go and English at B2+ are required.