Senior Cloud Security Engineer: IaC & Offensive Testing

Ondo Finance; United States; Remote; USD 180,000 - 240,000; Full time

Job summary

Ondo Finance is hiring a Senior Security Engineer to own security for cloud, network, and infrastructure-as-code. The role sits between platform engineering and security, writing and reviewing Terraform, gating Terraform with policies, and breaking things in staging to prove controls hold.

You will partner with Operations and Product Security to enhance cloud detection, infra threat modeling, and secure-by-default patterns across AWS and GCP. Remote US roles welcome.

Qualifications

• 3–5+ years in security engineering with cloud/infrastructure focus.
• Strong IaC skills with scale, able to explain failure modes of large IaC codebases.
• Production experience across AWS, GCP, or Azure.
• Hands-on experience with a cloud security platform.
• Strong scripting in Python or Go.

Responsibilities

• Own cloud security posture across AWS and GCP: IAM, network, encryption, logging, and account structure.
• Prioritize findings against real risk; drive remediation through engineering and measure progress.
• Design and enforce IaC guardrails: policy-as-code, modules, and CI gates to enforce secure paths.
• Lead identity and access design across cloud, IdP, and developer platforms; promote least‑privilege.
• Own secrets management strategy and migrate off long‑lived credentials where feasible.
• Run focused offensive testing against infra: cloud red-team scenarios, IAM privilege escalation, CI/CD supply-chain paths.

Skills

Cloud security

IaC

Python or Go

Kubernetes security

Tools

Terraform

CI/CD tooling

Kubernetes security tooling

Job description

Ondo Finance is hiring a Senior Security Engineer to own security for cloud, network, and infrastructure-as-code. The role sits between platform engineering and security, writing and reviewing Terraform, gating Terraform with policies, and breaking things in staging to prove controls hold.

You will partner with Operations and Product Security to enhance cloud detection, infra threat modeling, and secure-by-default patterns across AWS and GCP. Remote US roles welcome.