Staff Cloud Security Engineer — CSPM & CNAPP Lead

Toast; United States; Hybrid; USD 151,000 - 309,000; Full time

Benefits offered by this job

Hybrid work model

Competitive compensation

Job summary

Toast is seeking a Staff Engineer, Cloud Security to expand cloud security capabilities and lead hands-on security tooling and strategy across our AWS environments. You will mentor engineers, influence roadmaps, and build secure defaults into deployment pipelines.

You will work with Platform, Infrastructure, and product engineering leaders to reduce risk and improve detection, response, and remediation. A multi‑year security roadmap and strong communication are essential for success.

Qualifications

• 8+ years of security engineering, infrastructure, or software engineering with cloud security focus.
• Deep hands-on experience securing AWS environments at scale (IAM, Organizations, networking, logging).
• Experience deploying cloud security tooling (CNAPP/CSPM).
• Experience with container and Kubernetes security (EKS).
• Threat modeling and security architecture reviews for cloud services and platform capabilities.
• Security incident response in cloud environments.
• Proficiency with Terraform and at least one automation language (Python/Go).
• Track record of leading cross-team initiatives and setting multi-year roadmaps.
• Clear written and verbal communication of risk to engineers and leaders.

Responsibilities

• Own and operate CNAPP including coverage, tuning, and turning findings into actionable work for engineering teams.
• Lead CSPM across AWS, define standards and measure adherence.
• Drive IAM improvements, least privilege, role and permission design.
• Secure container environments, including image/workload security and runtime protection.
• Build guardrails and secure defaults into infrastructure as code and deployment pipelines.
• Perform secure architecture reviews and threat modeling for cloud services.
• Partner with SOC on cloud detection coverage, logging, and investigation readiness.
• Run and improve cloud vulnerability and misconfiguration remediation programs.

Skills

Cloud security

AWS security

CNAPP CSPM tooling

Container security

Threat modeling

Incident response

Infrastructure as Code

Python/Go scripting

Cross-team leadership

Security architecture direction

Tools

Orca

Wiz

Upwind

Terraform

Python

Go

EKS

Job description

Toast is seeking a Staff Engineer, Cloud Security to expand cloud security capabilities and lead hands-on security tooling and strategy across our AWS environments. You will mentor engineers, influence roadmaps, and build secure defaults into deployment pipelines.

You will work with Platform, Infrastructure, and product engineering leaders to reduce risk and improve detection, response, and remediation. A multi‑year security roadmap and strong communication are essential for success.