Cloud Security Architect

IDEXX; Boston (MA); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

Health / Dental / Vision Benefits from Day One

5% matching 401k

Annual cash bonus opportunity

Employee stock program

Job summary

IDEXX in Boston is seeking a Cloud Security Architect to enhance its multi-cloud security across AWS, Azure, and GCP. In this senior role, you'll architect cloud security posture management solutions and work closely with engineering and DevOps teams. With 7-10+ years of experience in information security and a keen understanding of CSPM tools, you'll influence security practices and improve compliance across complex cloud environments. The role offers a competitive salary and comprehensive benefits.

Qualifications

• 7 to 10+ years of experience in information security with at least 5 years focused on cloud security architecture.
• Hands-on experience implementing and operating CSPM solutions in multi-cloud environments.
• Proven track record architecting security controls for large-scale cloud deployments (1,000+ resources).

Responsibilities

• Architect and implement cloud security posture management across multiple cloud platforms.
• Lead migration of CSPM solutions ensuring compliance and visibility.
• Partner with DevOps to embed security controls in deployment pipelines.

Skills

Cloud Security Architecture

CSPM tools proficiency

Infrastructure-as-Code security scanning

DevOps collaboration

Communication skills

Education

Bachelor's degree in Computer Science or Information Security

Tools

CrowdStrike Falcon

Terraform

Checkov

Trivy

Job description

IDEXX Laboratories is seeking a Cloud Security Architect to lead our multi‑cloud security architecture across AWS, Azure, and GCP environments. This senior‑level position will architect and implement cloud security posture management (CSPM) solutions, drive security standards enforcement, and partner with engineering teams to embed security controls directly into cloud deployment pipelines. You will play a critical role in protecting applications that serve our global veterinary diagnostics business while enabling development teams to move fast without compromising security.

This position reports to the Senior Manager of Product & Application Security and works closely with DevOps engineers and cloud platform owners across the organization.

Cloud Security Architecture & CSPM

• Architect, implement, and continuously improve cloud security posture management across AWS, Azure, and GCP environments supporting hundreds of applications
• Lead the migration from AquaSec to CrowdStrike Falcon CSPM, ensuring continuity of visibility and compliance enforcement
• Establish and maintain compliance with CIS Benchmarks Level 1 standards across all cloud platforms
• Design monitoring and alerting strategies that surface actionable security gaps to both security and engineering teams

Infrastructure-as-Code Security

• Implement automated security scanning and policy enforcement for Terraform, CloudFormation, and other IaC frameworks
• Integrate tools like CrowdStrike Falcon, Checkov and Trivy into CI/CD pipelines to prevent misconfigurations before deployment
• Develop policy‑as‑code frameworks that codify security requirements and enable self‑service compliance

DevOps Partnership & Enablement

• Embed security controls directly into cloud deployment pipelines using native platform capabilities and third‑party tooling
• Partner with DevOps teams to build secure‑by‑default infrastructure templates and golden paths
• Conduct architecture reviews for new cloud services and deployment patterns
• Translate complex security requirements into practical, actionable guidance for engineering teams

Security Assessments & Risk Management

• Conduct cloud security assessments, threat modeling, and architecture reviews for critical workloads
• Identify and prioritize security risks based on business impact, exploitability, and compensating controls
• Work with product teams to implement mitigations that balance security effectiveness with operational feasibility

Tooling, Automation & Metrics

• Manage and optimize cloud‑native security tooling including CSPM, CNAPP, and secret scanning solutions
• Build automation to reduce manual security work and improve consistency of controls
• Establish metrics and reporting that demonstrate security posture improvement and compliance trends

What You Will Need To Succeed

Technical Expertise

• Deep hands‑on experience architecting security controls in AWS, Azure, and GCP production environments
• Demonstrated proficiency with CSPM tools (CrowdStrike Falcon, Wiz, Prisma Cloud, or similar platforms)
• Strong knowledge of CIS Benchmarks, cloud security frameworks (CSA CCM, NIST), and compliance standards (SOC 2, GDPR, HIPAA)
• Expertise in Infrastructure‑as‑Code security scanning and policy enforcement (Checkov, Trivy, Terraform Sentinel, OPA)
• Experience integrating security controls into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins, Azure DevOps)
• Solid understanding of container security, Kubernetes security, and serverless security patterns
• Proficiency with scripting and automation (Python, Bash, PowerShell)

Strategic & Operational Skills

• Proven ability to design security architectures that scale across large, complex cloud environments
• Track record of successfully partnering with DevOps and engineering teams to implement security without blocking delivery
• Experience driving security tool migrations and consolidations with minimal disruption
• Strong analytical skills to assess risk, prioritize work, and make pragmatic security decisions
• Ability to translate technical security concepts into language that resonates with both technical and business stakeholders

Leadership & Communication

• Excellent written and verbal communication skills; able to produce concise architecture documentation and executive summaries
• Demonstrated ability to influence engineering teams through technical credibility rather than authority
• Comfortable presenting security recommendations to senior technical leadership and defending design decisions
• Self‑directed and outcome‑focused; able to identify problems, propose solutions, and drive them to completion with minimal supervision

Required

• 7 to 10+ years of experience in information security with at least 5 years focused on cloud security architecture
• Hands‑on experience implementing and operating CSPM solutions in multi‑cloud environments
• Proven track record architecting security controls for large‑scale cloud deployments (1,000+ resources)
• Experience with CIS Benchmarks implementation and compliance enforcement
• Strong understanding of cloud‑native architecture patterns and security implications
• Bachelor's degree in Computer Science, Information Security, or equivalent practical experience

Preferred

• Relevant cloud security certifications (AWS Certified Security – Specialty, Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, CCSP)
• Experience with CrowdStrike Falcon CSPM or other leading CSPM/CNAPP platforms
• Background in DevSecOps, SRE, or cloud platform engineering
• Familiarity with OWASP SAMM or similar security maturity frameworks
• Prior experience in regulated industries (healthcare, financial services) with SOC 2, HIPAA, or PCI‑DSS compliance requirements
• Contributions to open‑source security tools or cloud security communities

What You Can Expect From Us

• Base annual salary target: $120000 - $150000
• Opportunity for annual cash bonus
• Health / Dental / Vision Benefits Day‑One
• 5% matching 401k
• Additional benefits including but not limited to financial support, pet insurance, mental health resources, volunteer paid days off, employee stock program, foundation donation matching, and much more!

What Success Looks Like

90 Days

Complete CrowdStrike Falcon CSPM migration from AquaSec with full visibility across AWS, Azure, and GCP
Establish baseline metrics for CIS Benchmarks Level 1 compliance across all cloud accounts
Conduct architecture reviews for 3‑5 high‑priority workloads and deliver actionable security recommendations
Build relationships with key DevOps and platform engineering stakeholders

6 Months

Achieve 80% CIS Benchmarks Level 1 compliance for existing cloud accounts and 95% for new accounts
Implement IaC security scanning in CI/CD pipelines for Terraform and CloudFormation with clear remediation workflows
Reduce cloud security findings requiring manual triage by 30% through automation and policy‑as‑code
Deliver secure‑by‑default infrastructure templates adopted by at least 5 product teams

12 Months

Demonstrate measurable improvement in cloud security posture through reduced CSPM findings and faster remediation times (MTTR)
Establish cloud security architecture review process integrated into product development lifecycle
Build reusable security automation that reduces repetitive manual work and improves consistency
Be recognized by engineering teams as a trusted partner who enables secure, fast delivery rather than blocking progress

Why IDEXX?

We’re proud of the work we do, because our work matters. An innovation leader in every industry we serve, we follow our Purpose and Guiding Principles to help pet owners worldwide keep their companion animals healthy and happy, to ensure safe drinking water for billions, and to help farmers protect livestock and poultry from diseases. We have customers in over 175 countries and a global workforce of over 10,000 talented people.

So, what does that mean for you? We enrich the livelihoods of our employees with a positive and respectful work culture that embraces challenges and encourages learning and discovery. At IDEXX, you will be supported by competitive compensation, incentives, and benefits while enjoying purposeful work that drives improvement.

Let’s pursue what matters together.

IDEXX values a diverse workforce and workplace and strongly encourages women, people of color, LGBTQ+ individuals, people with disabilities, members of ethnic minorities, foreign‑born residents, and veterans to apply.

IDEXX is an equal opportunity employer. Applicants will not be discriminated against because of race, color, creed, sex, sexual orientation, gender identity or expression, age, religion, national origin, citizenship status, disability, ancestry, marital status, veteran status, medical condition, or any protected category prohibited by local, state, or federal laws.