Hybrid Cloud Security Engineer - Terraform & Zero Trust

GranularTek LLC; Urbandale (IA); Hybrid; USD 110,000 - 170,000; Full time

Benefits offered by this job

Hybrid work model

Cloud certification stipends

Innovation days for R&D

Job summary

GranularTek LLC in Urbandale, IA is seeking a Cloud Security Engineer to architect and deploy security controls across AWS, Azure, and GCP using Terraform, CloudFormation, and Pulumi.

You will automate posture assessments, integrate vulnerability and IaC scanners into CI/CD, implement runtime protections, and build dashboards to monitor threats and compliance drift while collaborating with DevOps on GitOps and least-privilege enforcement.

Qualifications

• Must-have Terraform, AWS Security Hub, Azure Sentinel, CloudFormation, Snyk, Checkov, Wiz, CI/CD security integration.
• Preferred OCI or GCP security operations.
• Optional: Python or Bash scripting; Zero Trust Architecture.

Responsibilities

• Architect and deploy cloud-native security controls via Terraform, CloudFormation, and Pulumi.
• Automate security posture assessments using CIS benchmarks, AWS Config, Azure Policy, and GCP Security Health Analytics.
• Integrate vulnerability scanning (Snyk, Trivy, Qualys) and IaC scanning (Checkov, tfsec) into CI/CD pipelines.
• Implement runtime protection via CSPM, CWPP, and cloud-native EDR (Wiz, Lacework, Azure Defender).
• Build dashboards and alerting via Security Hub, Sentinel, and Grafana to monitor threats and compliance drift.
• Collaborate with DevOps to embed security into GitOps workflows and enforce least privilege at scale.

Tools

Terraform

AWS Security Hub

Azure Sentinel

CloudFormation

Snyk

Checkov

Wiz

CI/CD Security Integration

Python scripting

GCP Security Operations

Job description

GranularTek LLC in Urbandale, IA is seeking a Cloud Security Engineer to architect and deploy security controls across AWS, Azure, and GCP using Terraform, CloudFormation, and Pulumi.

You will automate posture assessments, integrate vulnerability and IaC scanners into CI/CD, implement runtime protections, and build dashboards to monitor threats and compliance drift while collaborating with DevOps on GitOps and least-privilege enforcement.