Staff Cloud Security Engineer — Build Secure‑by‑Default Cloud

Typeface; Palo Alto (CA); Hybrid; USD 210,000 - 240,000; Full time

Benefits offered by this job

Equity

Medical, dental, and vision insurance

HSA and FSA options

Flexible time off

Well-being programs

Daily lunch & snacks

Mentorship & impact

Job summary

Typeface is seeking a Staff Cloud Security Engineer to lead the security of our cloud platform. You will design, build, and operate the controls that protect our infrastructure end to end, ensuring enterprise marketers can move fast with confidence.

This role focuses on secure-by-default guardrails, IAM with least privilege, container security, Kubernetes, and secure CI/CD pipelines, while coordinating with Engineering, Product, IT and Compliance for audits and certifications.

Qualifications

• 10+ years in cloud security or security engineering with production-scale systems.
• Hands-on with major cloud platforms and security services.
• Experience with infrastructure as code and container security.

Responsibilities

• Lead design and implementation of security architecture across cloud environments.
• Build secure-by-default guardrails using IaC and policy as code.
• Own IAM, least-privilege, network security, and data protection practices.
• Secure containers, Kubernetes, and CI/CD pipelines and embed security in delivery.
• Monitor posture, remediate misconfigurations, and lead incident response.
• Collaborate with Engineering, Product, IT and Compliance for audits and certifications.

Skills

Cloud security

Security engineering

IAM

Kubernetes security

CI/CD security

Python

Docker

Communication

Education

Bachelor’s or Master’s in CS or related

Tools

Terraform

CloudFormation

Bicep

Kubernetes

AWS/Azure/GCP security services

Docker

Job description

Typeface is seeking a Staff Cloud Security Engineer to lead the security of our cloud platform. You will design, build, and operate the controls that protect our infrastructure end to end, ensuring enterprise marketers can move fast with confidence.

This role focuses on secure-by-default guardrails, IAM with least privilege, container security, Kubernetes, and secure CI/CD pipelines, while coordinating with Engineering, Product, IT and Compliance for audits and certifications.