Staff Cloud Security Engineer — AWS & CNAPP

Toast, Inc.; United States; Hybrid; USD 151,000 - 309,000; Full time

Job summary

Toast, Inc. is seeking a Staff Engineer, Cloud Security to shape the security direction of Toast's cloud platform. You will build and operate tooling, mentor engineers, and influence roadmaps across R&D. The role is hands-on with leadership responsibilities in AWS environments and CNAPP/CSPM programs.

Join a security-focused team that collaborates with Platform, Infrastructure, and product engineering to reduce risk through design, automation, and secure defaults in pipelines and deployments.

Qualifications

• 8+ years in security engineering with cloud focus.
• Deep AWS security experience at scale (IAM, Organizations, networking, logging).
• Experience deploying CNAPP or CSPM tooling (Orca, Wiz, Upwind).
• Experience container security (EKS) and Kubernetes security.
• Threat modeling and architecture reviews for cloud services.
• Security incident response in cloud environments.
• Proficiency with IaC (Terraform) and automation languages (Python/Go).
• Track record leading cross-team initiatives and multi-year security roadmaps.
• Clear written and verbal communication of risk and tradeoffs to engineers and leaders.

Responsibilities

• Own and operate CNAPP, tuning coverage, integrations, and turning findings into prioritized work for engineering teams.
• Lead CSPM across AWS organization and accounts, defining standards and measuring adherence.
• Drive IAM improvements, least privilege, and reducing standing access.
• Secure container environments, including image, workload security, and runtime protection.
• Build secure defaults into infrastructure as code and deployment pipelines.
• Perform secure architecture reviews and threat modeling for cloud services.
• Partner with SOC on cloud detection, logging, and investigation readiness.
• Run cloud vulnerability and misconfiguration remediation programs with engineering owners.
• Participate in security incident response, including on-call coverage and investigations.
• Set multi-year cloud security direction and mentor engineers on the team.
• Build relationships with Platform, Infrastructure, and product leaders to influence priorities.

Skills

AWS cloud security

CNAPP tooling

CSPM platforms

IAM / least privilege

Kubernetes security

Threat modeling

Security incident response

Infrastructure as code

Python or Go

Leadership without authority

Tools

Orca

Wiz

Upwind

EKS

Job description

Toast, Inc. is seeking a Staff Engineer, Cloud Security to shape the security direction of Toast's cloud platform. You will build and operate tooling, mentor engineers, and influence roadmaps across R&D. The role is hands-on with leadership responsibilities in AWS environments and CNAPP/CSPM programs.

Join a security-focused team that collaborates with Platform, Infrastructure, and product engineering to reduce risk through design, automation, and secure defaults in pipelines and deployments.