Staff Engineer (Cloud Security)

Join Toast, a company dedicated to empowering the restaurant industry through innovative technology. As a Staff Engineer in Cloud Security, you will play a crucial role in protecting our cloud infrastructure and services. You will work closely with various teams, shape our cloud security strategy, and mentor fellow engineers. Enjoy a range of benefits, including unlimited vacation, professional development reimbursement, and comprehensive health coverage.

Responsibilities

• Expand the scope and coverage of cloud security capabilities, including owning and operating the Cloud-Native Application Protection Platform (CNAPP).
• Lead cloud security posture management (CSPM) across the AWS organization and accounts, defining standards and measuring adherence over time.
• Drive identity and access management improvements, including least privilege, role and permission design, and reducing standing access.
• Proficiency with infrastructure as code (for example Terraform) and in at least one programming language used for automation (for example Python or Go)
• History of setting technical direction for a security domain, including a multi-year roadmap and the decisions behind it
• Clear written and verbal communication, including explaining risk and tradeoffs to engineers and leaders

Requirements

• Experience deploying and operating cloud security tooling, such as CNAPP or CSPM platforms (for example Orca, Wiz, or Upwind)

Experience responding to security incidents in cloud environments

• Deep, hands-on experience securing AWS environments at scale, including IAM, Organizations, networking, logging, and core security services
• 8+ years of experience in security engineering, infrastructure, or software engineering, with significant time focused on cloud security
• Experience with container and Kubernetes security (for example EKS)
• A track record of leading cross-team technical initiatives and influencing engineering teams without direct authority
• Experience performing threat modeling and security architecture reviews for cloud services and platform capabilities
• Experience with GCP, Azure, or other cloud platforms
• Relevant certifications, such as AWS Certified Security Specialty or CCSP

Preferred

• Experience with cloud detection engineering or incident response in cloud environments
• Experience mentoring engineers or growing a security function
• Familiarity with compliance frameworks relevant to payments and SaaS, such as PCI DSS or SOC 2

Pay

USD 151,000 - 309,000