Principal Cloud Security Engineer

HealthEquity; United States; Remote; USD 159,000 - 211,000; Full time

Benefits offered by this job

Performance-based incentives

Restricted stock units

Medical, dental, vision coverage

HSA contribution

Paid parental leave

Job summary

HealthEquity is seeking a Principal Cloud Security Engineer, Product Security, to lead cloud security posture across a large multi-subscription estate. You will design guardrails, policy-as-code, and automated controls that keep production resources secure.

You will collaborate with product and platform engineering teams to embed secure patterns, drive threat modeling, and mentor junior engineers while advancing HealthEquity's security posture and protecting member data.

Qualifications

• 12+ years of experience in cloud security and secure product development.
• Proven ability to lead secure architecture across multi-subscription estates.
• Hands-on experience with CNAPP/CSPM and policy-as-code guardrails.
• Strong scripting in Python, PowerShell, or Bash for automation.
• Deep knowledge of IAM, SSO, and least privilege concepts.
• Experience with threat modeling and security architecture reviews.
• Familiarity with healthcare or regulated industries is a plus.

Responsibilities

• Lead cloud security posture across a large multi-subscription estate.
• Design policy-as-code guardrails and CI/CD validation for secure delivery.
• Own security architecture for landing zones and provisioning.
• Develop event-driven auto-remediation at scale.
• Reduce customer-facing network exposure and tighten WAF rules.
• Drive IAM strategy across AWS, Azure, and GCP with least privilege.
• Coordinate security testing and remediation with teams and stakeholders.

Skills

Cloud security

CNAPP/CSPM

Policy as code

Python scripting

IAM & SSO

Threat modeling

App security

CI/CD security

Education

Bachelor's degree in CS/Engineering

AWS Certified Security - Specialty

CCSP/CISSP

Tools

AWS

Azure

CloudFormation

CDK

Terraform

Security Hub

GuardDuty

Sentinel

WAF

Job description

Our Mission

Come be part of remarkable.

Overview

How you can make a difference

As a Principal Cloud Security Engineer, Product Security, you provide technical leadership for the security of the cloud environments that host HealthEquity's products and platforms. Reporting to the VP, Head of Product Security, you design the posture management, policy-as-code guardrails, and automated controls that keep misconfigured and overexposed resources out of production across our environments.

You combine hands-on cloud engineering with sound architectural judgment. You define cloud security standards and reference architectures, build preventive and detective controls as code, and work with product and platform engineering teams so that secure patterns are the default path rather than a late-stage review. Your application security and threat modeling background keeps those controls tied to how HealthEquity's products are built and how they could be attacked.

The standards, guardrails, and automation you establish reduce public attack surface, shorten the time from detection to remediation, and let engineering teams deliver securely with less manual effort, in support of HealthEquity's responsibility to protect member data.

What You’ll Be Doing

• Lead the architecture and ongoing evolution of cloud security posture management across a large multi-subscription estate, using CNAPP/CSPM tooling to surface public exposure, misconfiguration, and risk, and driving prioritized remediation with product and platform teams.
• Design and build policy-as-code preventive guardrails, including service control policies, Azure Policy, and infrastructure-as-code validation in CI/CD, that block non-compliant infrastructure before it reaches production while applying defense-in-depth.
• Own the security architecture for cloud landing zones and account and subscription provisioning, so that newly created environments inherit security baselines, guardrails, and logging by default.
• Build event-driven auto-remediation that enforces security and compliance baselines at scale, and define when automated action is appropriate and when human review is required.
• Lead network exposure reduction for customer-facing applications, including web application firewall rule management, tighter security group and network security group ingress, and a move toward private connectivity.
• Define and evolve the IAM strategy for Azure, AWS, and GCP including federated identity, standardized SSO, least privilege, conditional access, and reduction of standing privilege.
• Lead threat modeling and architecture reviews for high-risk, cloud-hosted products and migrations, and scope and coordinate third-party penetration tests and audits, translating findings into prioritized remediation plans for engineering and executive stakeholders.
• Partner with Application Security and Vulnerability Management to build code scanning, secret detection, dependency analysis, and software supply chain controls into developer workflows and release gates, and support external researcher and bug bounty programs through scope, triage, and remediation SLAs.
• Establish security guardrails, governance requirements, and secure-adoption policy for AI services and AI-enabled development tooling in cloud environments, including managed model guardrails and Model Context Protocol (MCP) security.
• Set technical direction, identify systemic risks, recommend strategic improvements, and mentor and guide security engineers while driving the evolution of team tools, practices, standards, and automation capabilities.

This role requires deep, hands-on experience securing production cloud environments at enterprise scale, combined with the architectural judgment that comes from an application security background and the ability to provide technical leadership across teams.

Cloud Security Engineering Expertise

• Extensive experience architecting, building, and operating cloud security controls in production AWS and Azure environments, including multi-account and multi-subscription estates.
• Deep experience with CNAPP/CSPM platforms for posture management, exposure and attack-surface management, and risk-based prioritization of findings.
• Advanced proficiency with policy-as-code and preventive guardrails, such as SCPs, AWS Config rules, CloudFormation Guard, Azure Policy, and security validation of infrastructure-as-code (CloudFormation, CDK) within CI/CD pipelines.
• Strong working knowledge of AWS and Azure native security services, including Control Tower, Organizations, Security Hub, GuardDuty, Defender for Cloud, Sentinel, and cloud WAF and firewall services.
• Experience designing and operating event-driven automated remediation and detection that enforces security baselines across a cloud estate.
• Strong understanding of cloud network security, including security groups and NSGs, WAF, API gateways, and private connectivity patterns.
• Proficiency in Python, PowerShell, and Bash for security automation and tooling.

Identity, Application & AI Security Expertise

• Advanced knowledge of cloud identity and access management, including federated identity, SSO, SAML, OAuth 2.0, OIDC, least privilege, and conditional access.
• Strong foundation in application security, including threat modeling (STRIDE, attack trees), architectural security reviews, secure code review, OWASP Top 10, and CWE Top 25.
• Experience building vulnerability management and software supply chain programs, including SAST, secret scanning, software composition analysis, and triage and prioritization workflows that give developers actionable feedback.
• Working knowledge of the security risks of AI and LLM technologies, including model guardrails, MCP, and AI-assisted development tools, and the controls needed to adopt them safely.
• Hands‑on understanding of penetration testing and offensive security findings sufficient to scope engagements, evaluate results, and drive remediation.

Experience & Background

• 12+ years of experience in cloud security, security engineering, application security, or a closely related discipline, including significant time securing production cloud environments.
• Demonstrated experience architecting, delivering, and operating security solutions with broad organizational impact across a large cloud estate and many development teams.
• Experience serving as a technical lead and mentoring engineers, and leading initiatives across cross‑functional engineering and security teams without relying on direct authority.
• Ability to influence technical direction and clearly explain complex risks, tradeoffs, and findings to technical and non‑technical audiences, including senior leaders.
• Exceptional judgment in balancing security requirements with engineering practicality, business needs, and long‑term platform strategy.

Preferred Qualifications

• Experience defining and scaling security capabilities within CI/CD pipelines and developer workflows.
• Experience designing and operating a bug bounty or vulnerability disclosure program.
• Experience in healthcare, financial services, or another highly regulated industry.
• Strong working knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar regulatory and security frameworks.
• Relevant industry certifications such as AWS Certified Security - Specialty, Microsoft Azure security certifications, CCSP, CISSP, or comparable credentials.

This is a remote position.

Salary Range

$159000.00 To $210500.00 / year

Benefits & Perks

The actual compensation offer is determined based on job‑related knowledge, education, skills, experience, and work location. This position will be eligible for performance‑based incentives and restricted stock units as part of the total compensation package, in addition to a full range of benefits including:

• Medical, dental, and vision
• HSA contribution and match
• Dependent c are FSA match
• Uncapped p aid t ime o ff
• Paid p arental l eave
• 401(k) match
• Personal and healthcare financial literacy programs
• Ongoing e ducation& t uition a ssistance
• Gym and f itness r eimbursement
• Wellness p rogram incentives

Why work with HealthEquity

HealthEquity has a vision that by2030 we will make HSAs as wide‑spread and popular as retirement accounts. We are passionate about providing a solution that allows American families to connect health and wealth.

You belong at HealthEquity!

HealthEquity, Inc. is an equal opportunity employer, and we are committed to being an employer where no matter your background or identity – you feel welcome and included. We ensure equal opportunity for all applicants and employees without regard to race, age, color, religion, sex, sexual orientation, gender identity, national origin, status as a qualified individual with a disability, veteran status, or other legally protected characteristics. HealthEquity is a drug‑free workplace. For more information about our EEO policy, or about HealthEquity’s applicant disability accommodation, drug‑free‑workplace, background check, and E‑Verify policies, please visit our Careers page .

HealthEquity uses Microsoft Copilot to transcribe screening interviews between candidates and their direct Talent Partner for note taking and interview summaries. By scheduling a screening interview with us, you consent to Microsoft Copilot’s AI technology recording and transcribing your interview with your Talent Partner. This information will be reviewed for accuracy and then used by HealthEquity to summarize the interview, ensure accuracy, and facilitate our hiring process. We take privacy seriously. You have the option to opt out. If you wish to opt out of this Microsoft Copilot transcription, please notify your Talent Partner in advance of the interview. If we do not receive an opt‑out request from you, we will assume that you consent to the use of Microsoft Copilot.

HealthEquity uses Pindrop Pulse during certain interviews to support identity verification, interview security, and fraud prevention. By scheduling and participating in an interview where Pindrop Pulse is enabled, you acknowledge that Pindrop's technology may analyze information such as voice, video, device, network, and location‑related signals to identify potential impersonation, deepfake activity, and other security risks. This information may be reviewed by HealthEquity's Talent Acquisition and Security teams to support a secure hiring process. All alerts and risk indicators are reviewed by trained personnel, and HealthEquity does not make hiring decisions based solely on automated analysis. We take privacy seriously. You have the option to opt out of Pindrop analysis. If you wish to opt out, please notify your Talent Partner in advance of the interview. If we do not receive an opt‑out request before the interview, we will assume that you consent to HealthEquity's use of Pindrop Pulse for security verification purposes during the hiring process.

At HealthEquity, our goal is to save and improve lives by empowering healthcare consumers. This shared purpose inspires everything we do, including how we approach hiring. Our process is designed to get to know the real you: your skills, experiences, and potential to make a difference. We value honesty, originality, and the courage to do the right thing, even when it is not the easiest path. Showing up as your authentic self reflects these values and helps us build something truly remarkable together.

As AI is becoming a common tool throughout the application process, we want to be clear about its appropriate use at HealthEquity. Using AI to support resume writing, research, or interview preparation is perfectly acceptable, provided the content is accurate and genuinely represents your qualifications and skills. For other key parts of our interview process, however, it is important that the ideas, communication, and work you share reflect your own voice, experiences, and thinking. We ask that you participate in our live interviews and complete any assessments without AI assistance unless instructions explicitly indicate otherwise or a specific exception is discussed and approved in advance. This approach ensures fairness, celebrates your individuality, and allows your authentic perspective to shine. Behaviors that do not align with these guidelines may result in disqualification from the hiring process or termination of employment if later discovered. We appreciate your understanding and look forward to learning about the unique contributions only you can bring to HealthEquity.

HealthEquity is committed to your privacy as an applicant for employment. For information on our privacy policies and practices, please visit HealthEquity Privacy .