Lead Cloud Security Engineer (contract)

Thomson Reuters; Richmond (VA); On-site; USD 75,768 - 89,544; Full time

Benefits offered by this job

Medical benefits

Dental benefits

Vision benefits

Retirement benefits

Job summary

Thomson Reuters’ Information Security and Risk Management organization seeks a Senior Cloud Vulnerability Remediation Analyst to enhance our Cloud Security Engineering team. This role includes driving remediation outcomes across a multi-cloud environment by collaborating with application and engineering teams.

The ideal candidate will have over 5 years of experience in cloud security, coupled with strong communication skills and familiarity with platforms such as AWS, Azure, and GCP. This position offers a competitive pay range of $55-65/hr USD and optional benefits.

Qualifications

• 5+ years in cloud security or security remediation programs.
• Strong understanding of cloud security fundamentals.
• Demonstrated ability to drive remediation across teams.

Responsibilities

• Own remediation coordination across TR business units.
• Triage findings from cloud vulnerabilities and data security risks.
• Collaborate with security teams to enhance engagement strategies.

Skills

Cloud security

Vulnerability management

Stakeholder management

Automation (Python, Bash)

Education

5+ years of experience in cloud security

Tools

Terraform

AWS

Azure

GCP

ServiceNow

Job description

Thomson Reuters’ Information Security and Risk Management (ISRM) organization is seeking an experienced Senior Cloud Vulnerability Remediation Analyst to join our Cloud Security Engineering team. In this role, you’ll drive remediation outcomes across a complex, multi-cloud estate, partnering with application, platform, and service teams to turn security findings into clear, prioritized, and achievable remediation plans. You will be the connective tissue between Security Engineering and distributed engineering teams, fostering trust and collaboration across the business to mitigate cloud security risks.

Responsibilities

• Own remediation coordination and follow-through across TR business units to drive timely closure of cloud security findings.
• Triage and operationalize findings from Wiz across domains such as cloud misconfigurations, vulnerabilities, data security risks, and AI risks, ensuring the right teams have the right context to take action.
• Partner with engineering, architecture, and landing zone teams to confirm scope, reduce false positives, and ensure remediation guidance is actionable and aligned to cloud patterns.
• Track and report remediation performance, with an emphasis on backlog burndown, trend analysis, and executive-ready status updates.
• Collaborate across ISRM with peer security teams to strengthen business engagement strategies, standardizing communications, and identifying automation opportunities for workflow efficiency.

Qualifications

• 5+ years in cloud security, cloud operations, vulnerability management, or security remediation programs.
• Strong understanding of cloud security fundamentals and common misconfiguration and vulnerability classes in AWS, Azure, and/or GCP (multi-cloud experience strongly valued).
• Demonstrated ability to triage findings, drive remediation across multiple teams, and keep work moving forward through strong follow-up and stakeholder management.
• Experience translating technical findings into clear risk narratives and remediation plans for engineering audiences.
• Excellent written and verbal communication; comfort facilitating working sessions, aligning on action plans, and managing timelines.
• Familiarity with IaC technologies and delivery pipelines (Terraform/CloudFormation; CI/CD concepts and common tooling like GitHub workflows/CodePipeline/CodeDeploy).
• Experience working with CSPM/CNAPP platforms (Wiz, Prisma Cloud, etc.) and driving remediation outcomes.
• Basic scripting/automation skills (e.g. Python, Bash) to streamline operational tasks.

Preferred

• Familiarity with security compliance frameworks (NIST 800-53, FedRAMP, CIS, ISO 27001) and how they influence remediation prioritization.
• Familiarity with container and Kubernetes ecosystems (e.g. image scanning concepts, runtime vs build-time issues).
• Background working with ServiceNow for ticketing, workflow management, and remediation tracking.
• Familiarity with FedRAMP authorization and continuous monitoring requirements.

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

The pay range that the employer in good faith reasonably expects to pay for this position is $55-65/hr USD.

This posting is for an existing vacancy.

Our optional benefits can include medical, dental, vision and retirement benefits.

Applications will be accepted on an ongoing basis.

Tundra Technical Solutions (the operator of this Talent Community) is a global leader of contingent talent services. Our success and our clients’ success are built on a foundation of service excellence. We are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic. Qualified applicants with arrest or conviction records will be considered for employment in accordance with applicable law, including the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act. Unincorporated LA County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: client provided property, including hardware (both of which may include data) entrusted to you from theft, loss or damage; return all portable client computer hardware in your possession (including the data contained therein) upon completion of the assignment, and; maintain the confidentiality of client proprietary, confidential, or non-public information. In addition, job duties require access to secure and protected client information technology systems and related data security obligations.