Cloud Security Engineer

CloudMile; Hong Kong; Sur place; HKD 446 000 - 1 004 000; Plein temps

Avantages offerts par ce poste

Discretionary bonus

12 days annual leave

Medical coverage

Résumé du poste

CloudMile is seeking a Cloud Security Engineer to deliver enterprise cloud security solutions across Hong Kong, focusing on financial and enterprise sectors. You will implement cloud security posture management, automated vulnerability scanning and API-driven tooling, collaborating with local engineering teams to secure multi-cloud environments.

The role requires 3+ years hands-on cloud security with experience delivering to external clients; senior levels welcome with 5+ years.

Qualifications

• 3+ years hands-on in cloud security or infrastructure security; external client delivery is a must
• Solid knowledge of AWS, Azure or Google Cloud IAM, networking, logging and core security services
• Experience deploying CSPM/CNAPP, vulnerability management or SIEM/SOAR
• Proficient in REST APIs, webhooks and scripting (Python, Bash, PowerShell)
• Clear understanding of MITRE ATT&CK and cyber security fundamentals
• Fluent Cantonese and English; Mandarin working level for Greater China
• Willingness to work on-site in Hong Kong and participate in escalation rotations

Responsabilités

• Lead delivery of security projects from kickoff to handover
• Translate solution and SOW into delivery plans with milestones and risks
• Run on-site and remote sessions with client teams in Cantonese, English and Mandarin
• Deploy and tune KSPM/CSPM/CNAPP/CWPP and vulnerability scanning
• Prioritize findings by exploitability and drive remediation with DevOps/infra teams
• Produce posture reports aligned to CIS, NIST, ISO 27001 and HKMA/SFC
• Build secure Landing Zones and guardrails across AWS, Azure, GCP and Alibaba Cloud
• Onboard logs to SIEM/SOAR; tune detections and playbooks
• Handover to 24x7 MSSP and provide L3 escalation support
• Automate evidence collection and ticketing via REST APIs and scripts
• Codify security baselines with Terraform and policy-as-code
• Create design docs, runbooks and remediation guides for audits
• Share lessons learned with pre-sales and contribute templates

Connaissances

Cloud security

Cantonese & English fluency

Automation scripting

Outils

AWS

Azure

Google Cloud

Tenable

Prisma Cloud

Splunk

Fortinet

Palo Alto

SentinelOne

Terraform

ServiceNow

Jira

Description du poste

CloudMile is a leading enterprise-grade Artificial Intelligence, cloud, and security solutions provider in Asia. As an innovative company with a strong investment in R&D and technology, we are the first Google Premier Partners To acquire Infrastructure, Machine Learning, and Data Analytics Specialization in North Asia. Our team consists of talented professionals who believe in the power of cloud and artificial intelligence to enable our customers to achieve their goals.

Position Overview

We are seeking a Cloud Security Engineer to deliver enterprise cloud security solutions for clients across Hong Kong, with a focus on the financial and enterprise sectors. In this role, you will implement cloud security posture management, configure automated vulnerability scanning, integrate security tooling via modern APIs, and partner with local engineering teams to secure multi-cloud environments.

Key responsibilities

• Lead technical delivery of security projects from kick-off to handover: requirements workshops, solution design, build, UAT, go-live and knowledge transfer.
• Translate the pre-sales solution and SOW into a delivery plan; track milestones, risks and change requests with the PM and client.
• Run on-site and remote sessions with client IT, security and audit teams in Cantonese, English and Mandarin.

2. Cloud posture & Vulnerability management

• Deploy and tune KSPM / CSPM / CNAPP / CWPP and vulnerability scanning (e.g. Tenable Cloud Security & Vulnerability Management, Prisma Cloud, native CSP tools).
• Prioritise findings by exploitability and business impact, not CVSS alone; drive remediation with client DevOps and infra teams.
• Produce posture and exposure reports that map findings to CIS, NIST, ISO 27001 and HKMA / SFC expectations.
• Build secure Landing Zones and guardrails (org policies, SCPs / Azure Policy, logging, KMS, network segmentation) on AWS, Azure, GCP and Alibaba Cloud.
• Implement identity security and Zero Trust controls (Okta, cloud IAM, MFA, least privilege, CIEM).
• Integrate network and endpoint controls (Fortinet, Palo Alto, Bitdefender, SentinelOne) into the client's cloud estate.

4. SecOps onboarding & managed service handover

• Onboard log sources into SIEM / SOAR (Google SecOps, Splunk, Rizhiyi, FortiSIEM): ingestion, parsing, detection rules and response playbooks.
• Integrate Google Threat Intelligence / Mandiant feeds; tune detections to cut false positives.
• Hand over cleanly to the 24x7 MSSP team; act as L3 escalation for the environments you built, including occasional out-of-hours support during incidents.

5. Automation & integration

• Automate evidence collection, alert triage and ticketing via REST APIs, webhooks and scripts (Python, Bash, PowerShell), connecting scanners and SIEM to ITSM / chat tools (ServiceNow, Jira, Slack, Teams).
• Codify security baselines with IaC (Terraform) and policy-as-code where possible.

6. Documentation & knowledge

• Write design documents, runbooks, remediation guides and handover packs that pass client audit and internal review.
• Feed field lessons back to pre-sales and contribute to reusable delivery templates.
• Experience: 3+ years hands-on in cloud security, security engineering or infrastructure security, with at least 1 year delivering to external clients (SI, MSP, MSSP, consultancy or vendor professional services). Senior level: 5+ years and has led delivery end-to-end.
• Cloud: Solid working knowledge of at least one of AWS, Azure or Google Cloud — IAM, networking, logging and core security services.
• Security tooling: Hands-on deployment of at least one of: CSPM / CNAPP, vulnerability management, SIEM / SOAR, or EDR.
• Automation: Can integrate tools via REST APIs and webhooks and write working scripts in Python, Bash or PowerShell.
• Fundamentals: Clear understanding of network security, identity, encryption, logging and common attack techniques (MITRE ATT&CK).
• Languages: Fluent Cantonese and English, spoken and written, including technical documentation. Mandarin at working level for Greater China clients and partners.
• Mobility: Able to work on-site at client premises in Hong Kong and join an escalation rota for managed-service clients.

Preferred qualifications

• Multi-cloud: Experience across two or more of AWS, Azure, GCP, Alibaba Cloud, Tencent Cloud or Huawei Cloud.
• Regulated delivery: Projects for banks, virtual banks, insurers, SFC-licensed firms or HKSAR Government / public bodies; familiarity with HKMA C-RAF and TM-G-1, SFC cybersecurity requirements, PDPO, and the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653).
• SecOps depth: Google SecOps (Chronicle) — UDM, YARA-L detections, SOAR playbooks — or equivalent Splunk / Sentinel experience.
• Exposure management: Tenable One or Prisma Cloud administration; CTEM programme experience.
• Infrastructure as Code: Terraform, CI/CD pipeline security, container and Kubernetes security.
• Certifications (any of):
• Cloud: AWS Security – Specialty, Azure AZ-500 / SC-200, Google Professional Cloud Security Engineer, Alibaba Cloud ACP Security
• Security: CISSP, CCSP, CISA, CISM, CompTIA Security+ / CySA+
• Offensive (a plus, not required): OSCP, OSEP, CRT
• Monthly salary depending on experience.
• Discretionary bonus.
• 12 days annual leave.
• Medical coverage.

Join our team of "CloudMilers" and contribute to an innovative culture that strives to be the leading provider of AI, cloud, and security solutions in Asia.