Staff Cloud Security Engineer — Identity, Secrets & IAM

Arena; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Competitive compensation

Health benefits

Career growth opportunities

Mission-driven team

Job summary

Arena Intelligence is seeking a staff-level cloud security engineer to strengthen the controls protecting our cloud infrastructure. You’ll define workload identity, manage secrets, and enforce security boundaries across AWS, GCP, and build pipelines.

This hands-on role requires collaboration with platform, infra, and product engineers to elevate our security posture in a fast-growing AI-focused environment.

Qualifications

• Extensive security or infrastructure engineering experience, incl. 3+ yrs cloud security in production.
• Deep hands-on experience securing AWS, GCP, and Cloudflare.
• Ownership of cloud security architecture and secret management.
• Deep knowledge of workload identity, OIDC, and secret rotation.
• Ability to rotate production credentials without outages.
• Experience writing detections and incident response in cloud environments.
• Familiarity with IaC (Terraform) and automation languages (Python/Go/TS).
• Experience securing build pipelines and CI/CD like GitHub Actions.

Responsibilities

• Design the cloud identity model for workloads with least-privilege access.
• Own machine secrets and rotation end-to-end with centralized secret management.
• Define environment boundaries and outbound access rules for cloud services.
• Build detections and runbooks for cloud infra security events.
• Embed security checks into infrastructure code and pipelines for a secure path.
• Secure credentials used by source control, build pipelines, and deployments.
• Assess vendor access requests and onboarding from a security perspective.
• Lead incident response for cloud infra security events and coordinate recovery.

Skills

Cloud security

AWS/GCP/Cloudflare

Workload identity & IAM

Secret management & rotation

Terraform

CI/CD security

Python/Go/TypeScript

Incident response

Security automation

Tools

Terraform

GitHub Actions

Job description

Arena Intelligence is seeking a staff-level cloud security engineer to strengthen the controls protecting our cloud infrastructure. You’ll define workload identity, manage secrets, and enforce security boundaries across AWS, GCP, and build pipelines.

This hands-on role requires collaboration with platform, infra, and product engineers to elevate our security posture in a fast-growing AI-focused environment.