Senior Cloud Security Engineer | IAM & PCI/SOC Ready

PayCargo, LLC; New York (NY); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Competitive salary

401K match

Healthcare benefits

Paid time off

Job summary

PayCargo is looking for a Senior Engineer, Cloud Security to strengthen and operate security controls across a modernizing platform spanning a multi-account AWS environment, Entra ID, GitHub workflows, and secure AI requirements. This is a hands-on IC role within the DevSecOps team, driving secure patterns and repeatable controls.

You will monitor, harden, and evolve security across cloud and endpoints, lead incident response, conduct access reviews, and collaborate with DevOps, Architecture,

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field.
• 5+ years of hands-on security engineering, cloud security, or security operations experience preferred.
• Strong working knowledge of AWS security and identity services, plus an enterprise identity provider such as Microsoft Entra ID or Okta.
• Practical experience with SOC and/or PCI DSS controls, audits, and evidence.
• Strong understanding of IAM, RBAC/ABAC, MFA, SSO, SAML2, OAuth2/OIDC, JWT, including common failure modes, and least-privilege design.
• Hands-on experience with PKI and certificates, including a certificate authority such as AWS Private CA, TLS and mTLS, and certificate issuance, rotation, and revocation.
• Experience with incident response, logging and alerting, and root cause analysis
• Ability to convert security and compliance requirements into repeatable operational controls.

Responsibilities

• Monitor the perimeter, cloud, and endpoint environments for threats, misconfigurations, and anomalous activity across AWS and Microsoft Entra ID.
• Operate and tune security tooling, including CrowdStrike, Microsoft Defender, and CloudWatch and SNS logging and alerting.
• Triage security alerts, drive incident response, and lead root cause analysis with clear, durable follow-up.
• Maintain and improve on-call and escalation workflows (e.g., PagerDuty) so security events are handled consistently.
• Run periodic access reviews and enforce least privilege across AWS IAM and IAM Identity Center, Microsoft Entra ID, and SaaS platforms.
• Strengthen RBAC/ABAC, MFA, and SSO, SAML2, and OAuth2/OIDC patterns across internal and customer-facing systems.
• Reduce standing access and broad repository or local admin privileges in favor of bounded, auditable access.
• Operate the federated access model, including SAML-based assumed access to AWS and GitHub OIDC for pipelines.
• Operate the PKI, including AWS Private CA and ACM, certificate issuance and rotation, CRLs, and mTLS trust stores on load balancers.
• Administer Entra ID groups and the Tailscale ACLs that gate network access.
• Govern dependency and supply-chain risk using Dependabot and approved-package practices, and keep secrets in AWS Secrets Manager and SSM Parameter Store.
• Coordinate penetration testing, remediation tracking, and verification of fixes.
• Produce clean, repeatable audit evidence and reduce last-minute audit scrambles.

Skills

Cloud security

AWS security

Threat detection

Identity & access

Incident response

Zero trust

CI/CD security

Security operations

Audit & compliance

Security tooling

Education

Bachelor's degree

Tools

CrowdStrike

Microsoft Defender

CloudWatch

SNS

Entra ID

GitHub Actions

Terraform

AWS Private CA

ACM

SSM Parameter Store

CommonFate Granted

Job description

PayCargo is looking for a Senior Engineer, Cloud Security to strengthen and operate security controls across a modernizing platform spanning a multi-account AWS environment, Entra ID, GitHub workflows, and secure AI requirements. This is a hands-on IC role within the DevSecOps team, driving secure patterns and repeatable controls.

You will monitor, harden, and evolve security across cloud and endpoints, lead incident response, conduct access reviews, and collaborate with DevOps, Architecture,