Principal Cloud Security Engineer

Digitailor; United States; Remote; USD 180,000 - 260,000; Full time

Benefits offered by this job

Medical, dental, and vision

HSA contribution and match

Dependent care FSA match

Uncapped paid time off

Paid parental leave

401(k) match

Wellness program incentives

Job summary

HealthEquity is seeking a Principal Cloud Security Engineer, Product Security, to lead cloud security posture across a large multicloud estate. You will design guardrails, implement policy-as-code, and coordinate remediation with product and platform teams to secure production environments.

Your background in application security and threat modeling will ensure security patterns are the default. You will mentor engineers and evolve security tooling and automation across the organization.

Qualifications

• 12+ years in cloud security or related discipline.
• Experience securing production cloud environments at enterprise scale.
• Ability to mentor engineers and lead cross-functional initiatives.

Responsibilities

• Lead architecture and evolution of cloud security posture management across a large, multi-subscription estate.
• Design policy-as-code guardrails to block non-compliant infrastructure in CI/CD.
• Own security architecture for cloud landing zones, accounts, and provisioning with secure baselines.
• Build event-driven auto-remediation for security baselines at scale.
• Lead network exposure reduction for customer-facing apps and private connectivity.
• Define IAM strategy across AWS, Azure, and GCP with least privilege and conditional access.
• Coordinate third-party tests, translate findings to prioritized remediation plans.
• Integrate code scanning, secret detection, and software supply chain controls into developer workflows.

Skills

CNAPP/CSPM

Policy-as-code

Cloud security architecture

AWS/Azure/GCP security

Security automation

Python

PowerShell

Bash

Threat modeling

Incident response

Tools

AWS

Azure

GCP

CloudFormation

CDK

Azure Policy

CNAPP tooling

Job description

Our mission is to SAVE AND IMPROVE LIVES BY EMPOWERING HEALTHCARE CONSUMERS. Come be part of remarkable. How you can make a difference As a Principal Cloud Security Engineer, Product Security , you provide technical leadership for the security of the cloud environments that host HealthEquity's products and platforms. Reporting to the VP, Head of Product Security, you design the posture management, policy-as-code guardrails, and automated controls that keep misconfigured and overexposed resources out of production across our environments. You combine hands-on cloud engineering with sound architectural judgment. You define cloud security standards and reference architectures, build preventive and detective controls as code, and work with product and platform engineering teams so that secure patterns are the default path rather than a late-stage review. Your application security and threat modeling background keeps those controls tied to how HealthEquity's products are built and how they could be attacked. The standards, guardrails, and automation you establish reduce public attack surface, shorten the time from detection to remediation, and let engineering teams deliver securely with less manual effort, in support of HealthEquity's responsibility to protect member data. What you’ll be doing Lead the architecture and ongoing evolution of cloud security posture management across a large multi-subscription estate, using CNAPP/CSPM tooling to surface public exposure, misconfiguration, and risk, and driving prioritized remediation with product and platform teams. Design and build policy-as-code preventive guardrails, including service control policies, Azure Policy, and infrastructure-as-code validation in CI/CD, that block non-compliant infrastructure before it reaches production while applying defense-in-depth. Own the security architecture for cloud landing zones and account and subscription provisioning, so that newly created environments inherit security baselines, guardrails, and logging by default. Build event-driven auto-remediation that enforces security and compliance baselines at scale, and define when automated action is appropriate and when human review is required . Lead network exposure reduction for customer-facing applications, including web application firewall rule management, tighter security group and network security group ingress, and a move toward private connectivity. Define and evolve the IAM strategy for Azure, AWS, and GCP including federated identity, standardized SSO, least privilege, conditional access, and reduction of standing privilege. Lead threat modeling and architecture reviews for high-risk, cloud-hosted products and migrations, and scope and coordinate third-party penetration tests and audits, translating findings into prioritized remediation plans for engineering and executive stakeholders. Partner with Application Security and Vulnerability Management to build code scanning, secret detection, dependency analysis, and software supply chain controls into developer workflows and release gates, and support external researcher and bug bounty programs through scope, triage, and remediation SLAs. Establish security guardrails, governance requirements, and secure-adoption policy for AI services and AI-enabled development tooling in cloud environments, including managed model guardrails and Model Context Protocol (MCP) security. Set technical direction, identify systemic risks, recommend strategic improvements, and mentor and guide security engineers while driving the evolution of team tools, practices, standards, and automation capabilities. What you will need to be successful This role requires deep, hands-on experience securing production cloud environments at enterprise scale, combined with the architectural judgment that comes from an application security background and the ability to provide technical leadership across teams. Cloud Security Engineering Expertise Extensive experience architecting, building, and operating cloud security controls in production AWS and Azure environments, including multi-account and multi-subscription estates. Deep experience with CNAPP/CSPM platforms for posture management, exposure and attack-surface management, and risk-based prioritization of findings. Advanced proficiency with policy-as-code and preventive guardrails, such as SCPs, AWS Config rules, CloudFormation Guard, Azure Policy, and security validation of infrastructure-as-code (CloudFormation, CDK) within CI/CD pipelines. Strong working knowledge of AWS and Azure native security services, including Control Tower, Organizations, Security Hub, GuardDuty, Defender for Cloud, Sentinel, and cloud WAF and firewall services. Experience designing and operating event-driven automated remediation and detection that enforces security baselines across a cloud estate. Strong understanding of cloud network security, including security groups and NSGs, WAF, API gateways, and private connectivity patterns. Proficiency in Python, PowerShell, and Bash for security automation and tooling. Identity, Application & AI Security Expertise Advanced knowledge of cloud identity and access management, including federated identity, SSO, SAML, OAuth 2.0, OIDC, least privilege, and conditional access. Strong foundation in application security, including threat modeling (STRIDE, attack trees), architectural security reviews, secure code review, OWASP Top 10, and CWE Top 25. Experience building vulnerability management and software supply chain programs, including SAST, secret scanning, software composition analysis, and triage and prioritization workflows that give developers actionable feedback. Working knowledge of the security risks of AI and LLM technologies, including model guardrails, MCP, and AI-assisted development tools, and the controls needed to adopt them safely. Hands‑on understanding of penetration testing and offensive security findings sufficient to scope engagements, evaluate results, and drive remediation. Experience & Background 12+ years of experience in cloud security, security engineering, application security, or a closely related discipline, including significant time securing production cloud environments. Demonstrated experience architecting, delivering, and operating security solutions with broad organizational impact across a large cloud estate and many development teams. Experience serving as a technical lead and mentoring engineers, and leading initiatives across cross-functional engineering and security teams without relying on direct authority. Ability to influence technical direction and clearly explain complex risks, tradeoffs, and findings to technical and non-technical audiences, including senior leaders. Exceptional judgment in balancing security requirements with engineering practicality, business needs, and long-term platform strategy.

Preferred Qualifications

Experience defining and scaling security capabilities within CI/CD pipelines and developer workflows. Experience designing and operating a bug bounty or vulnerability disclosure program. Experience in healthcare, financial services, or another highly regulated industry. Strong working knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar regulatory and security frameworks. Relevant industry certifications such as AWS Certified Security - Specialty, Microsoft Azure security certifications, CCSP, CISSP, or comparable credentials. #LI-Remote This is a remote position. The actual compensation offer is determined based on job-related knowledge, education, skills, experience, and work location. This position will be eligible for performance-based incentives and restricted stock units as part of the total compensation package, in addition to a full range of benefits including: Medical, dental, and vision HSA contribution and match Dependent c are FSA match Uncapped p aid t ime o ff Paid p arental l eave 401(k) match Personal and healthcare financial literacy programs Ongoing e ducation & t uition a ssistance Gym and f itness r eimbursement Wellness p rogram incentives