Senior AWS Cloud Security Engineer — CSPM & Terraform

Jobtailor; North Carolina; On-site; USD 150,000 - 210,000; Full time

Job summary

LPL is seeking a senior cloud security engineer to codify and evolve the cloud control library across Security Hub CSPM, AWS Config conformance packs, and related guardrails. You will drive triage of findings, partner with Security Engineering, and contribute to secure-by-default foundations in multi-account Terraform environments.

The role demands hands-on Terraform, vulnerability triage, on-call resilience, and collaboration with cross-functional pods to raise the security posture of the

Qualifications

• 7+ years of progressive technical experience including 3+ years in a senior cloud security, network security, or cloud infrastructure engineering role
• Bachelor's degree in Computer Science, Engineering, or a related discipline (or equivalent work experience)
• 3+ years of hands-on production AWS at scale in a multi-account landing zone with strong production Terraform delivered through Terraform Cloud and GitHub Actions
• 3+ years experience operating as a senior individual contributor (AVP, Senior Engineer, Staff Engineer, or equivalent), influencing technical direction and uplifting peer engineers without direct authority — including code review leadership, design-review participation, and technical mentorship
• 3+ years experience personally participating in 24x7 production on-call rotations in a fast-paced, security-conscious, regulated environment (financial services strongly preferred)
• 5+ years hands-on production experience codifying cloud security controls in Security Hub CSPM and AWS Config (including custom conformance packs), with awareness of the broader CSPM and control-management landscape (Wiz, Prisma Cloud, Lacework, Orca) and how those systems integrate with Security Hub

Responsibilities

• Codify and continuously improve cloud control library — Security Hub CSPM as today’s AWS-native control system and triage Security Hub findings within CCOE
• Partner with Security Engineering to monitor Wiz signal and drive resolution of Wiz findings
• Contribute to Account Factory for Terraform — security-control modules, AWS Config conformance packs, and reference patterns
• Support enterprise vulnerability management by triage, prioritization, and remediation guidance for AWS-related findings
• Operate as security & governance partner across all CCOE teams and pods; embed security review into design, code, and delivery touchpoints
• Collaborate with Network Engineering on shared network-security controls including segmentation, encryption, WAF, and certificate lifecycle
• Evaluate, pilot, and operationalize CNAPP, CSPM, CWPP, runtime defense, DSPM, and secrets scanning to meet InfoSec requirements
• Translate FINRA, SEC, PCI, SOX into automated controls; lead cloud-security incident response and drive durable control improvements
• Embed AI capabilities into engineering practice and platform self-service for internal customers
• Embed AI in security governance via automated control authoring and SQL-like queryable views
• Hands-on senior cloud engineer focusing on Terraform code, security tooling, vulnerability remediation, and incident response
• Participate in 24x7 on-call rotations as a senior technical responder and escalation point
• Align roadmaps across CCOE teams and foundations pods to remove blockers
• Champion AWS Well-Architected Framework adoption with emphasis on Security pillar
• Contribute to private Terraform module library and AFT base layer
• Raise engineering quality through code review and design partnership
• Participate in Agile/Scrum ceremonies and coordinate with RTE/PMO
• Represent pod security posture in architecture reviews, audits, and customer engagements

Skills

AWS Cloud Security

Terraform

AWS Config

Security Hub CSPM

Wiz

GitHub Actions

On-call rotations

CSPM tooling

Education

Bachelor's degree in Computer Science or Engineering

Tools

Terraform

GitHub Actions

Terraform Cloud

AWS Config

Security Hub

Wiz

Job description

LPL is seeking a senior cloud security engineer to codify and evolve the cloud control library across Security Hub CSPM, AWS Config conformance packs, and related guardrails. You will drive triage of findings, partner with Security Engineering, and contribute to secure-by-default foundations in multi-account Terraform environments.

The role demands hands-on Terraform, vulnerability triage, on-call resilience, and collaboration with cross-functional pods to raise the security posture of the