Lead Cloud Security Engineer

The Vanguard Group; Malvern (Chester County); Hybrid; USD 140,000 - 200,000; Full time

Job summary

The Vanguard Group in Malvern, PA seeks a senior cloud security engineer to lead design and delivery of scalable controls across enterprise cloud deployments. You will mentor engineers, set coding and security standards, and shape policy-driven automation for secure cloud adoption.

Hybrid work model supported; emphasis on hands-on coding (Python), IaC (CloudFormation/Terraform), and security tooling with CI/CD integrations to ensure auditability and resilience across services.

Qualifications

• Seven+ years related work experience, with four+ years in cloud or security engineering preferred.
• Hands-on engineering — writes and ships production-grade code (Python or equivalent) and heavy hands-on infrastructure-as-code.
• Familiarity with policy-as-code, CI/CD integrations, code repositories and pipelines.
• Deep cloud expertise across AWS, with org-wide account structures and security patterns at scale.
• Knowledge of IAM policy mechanics — inline, customer-managed, permission boundaries, SCPs, and resource/identity policies.

Responsibilities

• Lead technical design reviews and own the standards for how controls are built, tested, and shipped.
• Train, mentor, and coach engineers on technology standards, best practices, and frameworks; resolve complex issues.
• Influence engineering patterns and best practices across teams; drive technical direction beyond your immediate team.
• Design enterprise-scale solutions (policy pipelines, event-driven remediation) that other engineers build on.
• Evaluate and select tooling and patterns for the broader team; own technical standards for controls connections to enterprise infrastructure.
• Move between design and hands-on build; stay close to the code.
• Automate posture checks, drift detection, and event-driven remediation; explore AI/ML tooling where appropriate.

Skills

Technical leadership

Hands-on engineering

Python

Infrastructure as Code

CloudFormation

Terraform

AWS security

CI/CD automation

Policy-as-code

Cross-cloud expertise

Security auditing/compliance

Education

Undergraduate degree

Tools

GitHub

CloudFormation

Terraform

boto3

AWS CLI

Job description

The stack you'll work with:

Core — Hands-on day one AWS IAM — roles, policies, trust and resource-policy patterns, permission boundaries, SCPs.
CloudFormation (JSON/YAML) — heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits).
Python for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3).
CI/CD pipelines (GitHub Actions, Bamboo, or similar) for building, testing, and shipping controls.
Core AWS at org scale — Organizations, IAM Identity Center, and services such as Lambda, EventBridge, Step Functions, S3, API Gateway, and CloudWatch.
Nice to have — or you'll pick up fast Security-native AWS — Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS.
CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana).
Data skills (SQL and JSON, ETL, Tableau/Power BI).
Multi-cloud exposure (GCP, Azure, OCI).
PowerShell, PySpark, and AI-assisted tooling.

Core Responsibilities:

• Technical Leadership Lead technical design reviews and own the standards for how controls are built, tested, and shipped — raising the bar on code quality, systems thinking, and operational readiness.
• Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff.
• Influence engineering patterns and best practices across teams — driving technical direction beyond your immediate team, without direct authority.
• Solution Design & Delivery Design enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on — designing for auditability, fault tolerance, and graceful degradation when upstream systems change.
• Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts — owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM).
• Move fluidly between design and hands‑on build; stay close to the code.
• Automation & Infrastructure as Code Build preventive and detective controls as code — author, test, and stage‑roll guardrails so they land safely in production, using infrastructure‑as‑code (CloudFormation and/or Terraform) and policy‑as‑code (Rego/OPA).
• Embed controls into CI/CD pipelines and runtime configuration checks; own the build‑break vs. detect‑and‑alert decision for each control.
• Automate posture checks, drift detection, and event‑driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate).
• Security Engineering & Strategy Engineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event‑driven remediation) that operate at org scale.
• Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls.
• Translate enterprise security strategy, audit requirements, and risk priorities into well‑defined technical work, and measure control coverage and effectiveness.
• Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on‑call rotation, and special projects as needed.

Qualifications:

• Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred. Strong hands‑on engineering — writes and ships production‑grade code (Python or equivalent — production‑grade, not just scripting) and heavy hands‑on infrastructure‑as‑code, with CloudFormation day to day (Terraform a plus).
• Deep cloud expertise — hands‑on experience across at least one of AWS, GCP, or Azure (AWS strongly preferred), at the level of org‑wide account structures, landing zones, and cross‑account security patterns at scale.
• Technical leadership & influence — a track record of leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction across teams without direct authority.
• Security judgment — reasons about trust boundaries, least privilege, and blast radius; can threat‑model what goes wrong when access is too broad.
• Familiarity with AWS IAM policy mechanics — inline, customer‑managed, permission boundaries, SCPs, RCPs, and resource/identity policies — is a plus; depth here is learnable on the job.
• Experience working directly with engineering teams on policy‑as‑code, CI/CD integrations, code repositories and pipelines (GitHub or similar), and cloud security tooling.
• Experience operating in regulated or audit‑driven environments.
• Relevant certification (e.g. AWS Security Specialty or a Professional‑level AWS certification) is a plus, not required.
• Undergraduate degree in a related field or the equivalent combination of training and experience.

Why This Role Matters:

This role is central to reducing enterprise risk, enabling secure cloud adoption, and operationalizing cloud security strategy through engineering. Success is measured by technical coverage, control effectiveness, and platform trust. You will directly shape how cloud security controls are designed, built, and adopted across Vanguard.

Special Factors Sponsorship

Vanguard is not offering visa sponsorship for this position.

About Vanguard

At Vanguard, we don't just have a mission—we're on a mission. To work for the long‑term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in‑person learning, collaboration, and connection. We believe our mission‑driven and highly collaborative culture is a critical enabler to support long‑term client outcomes and enrich the employee experience.

Vanguard, one of the world's leading investment management companies, serves individual investors, institutions, employer‑sponsored retirement plans, and financial professionals. We have a diverse and talented crew with a culture that promotes teamwork, along with an unwavering focus on serving our clients' best interests.