​​Senior Cloud Security Engineering Lead​

ROLE RESPONSIBILITIES 

The Senior Cloud Security Engineering Lead provides technical leadership and design expertise for the secure engineering of Pfizer's multi-cloud estate, and leads a small technical team of 3-5 cloud security engineers, providing guidance, mentorship and support in their professional development.

Security Engineering & Architecture 

• Lead the design, implementation and management of multi-cloud security solutions focusing on preventative controls, scalability and automation. 

• Own cloud security reference architectures, guardrails and landing zone controls across AWS, Azure and GCP. 

• Design and architect standards for secure deployment and management of multi-cloud infrastructure, embedding security into platform patterns rather than bolting it on. 

• Drive the adoption of policy-as-code and Infrastructure as Code security using Terraform, OpenTofu, Spacelift and Python. 

Platform Automation & Detection Engineering 

• Lead automation of security control deployment, posture remediation, and evidence collection across the cloud estate. 

• Own detection engineering, logging pipelines and observability for cloud security telemetry at enterprise scale. 

• Serve as escalation point for cloud security operational issues and lead root cause analysis for significant incidents.

Leadership & Collaboration 

• Manage and mentor a team of 3-5 cloud security engineers, providing technical leadership, coaching and career development. 

• Partner with Cyber Security, Risk, Compliance and Architecture teams to support audits, GxP and regulatory requirements, and governance initiatives. 

• Collaborate with global cloud engineers, developers and product teams to build secure-by-default cloud-native capabilities. 

• Ensure continuous improvement initiatives are identified, prioritized and addressed within the cloud security environment. 

• Stay ahead of cloud security threats, technologies and engineering practices, and set the direction for their adoption.

Cyber Security Applications & Platforms in Scope 

• The role engineers, secures and operates the cloud infrastructure underpinning Pfizer's core cyber security application estate, including: 

• Ping - enterprise identity and access management / federation and single sign-on. 

• SailPoint - identity governance and administration, access certification and lifecycle management. 

• CyberArk (Palo Alto Idira) - privileged access management, secrets management and credential vaulting. 

• CrowdStrike Amazon EKS - large-scale security log ingestion, retention and threat hunting.

Cutting-Edge & Agentic Cloud Security Capabilities 

• This role sits at the front edge of AI-enabled security engineering. You will work with, evaluate, and operationalize emerging agentic capabilities that are reshaping how cloud security is delivered, including: 

• Developer-embedded secret and credential protection - preventing credentials and secrets from ever reaching a repository, using GitHub Advanced Security (GHAS) push protection, secret scanning, code scanning and dependency review. 

• Autonomous security agents for offensive testing - agent-driven penetration testing (black-box against external cloud estates and white-box against our own accounts) and continuous AI-assisted source code security review. 

• AI red team and blue team agents within our cloud-native application protection tooling - using agentic red teaming to continuously probe cloud configurations and workloads, and blue team agents to accelerate detection, triage and response. 

• AI-assisted vulnerability remediation - evaluating and adopting emerging code-repair models that generate and validate security fixes rather than only reporting findings. 

• Hyperscaler-native security agents - early access and alpha programs from AWS, Microsoft and Google that bring agentic reasoning to cloud security posture, threat detection and automated remediation. 

• Agentic security engineering at scale - building the guardrails, evaluation harnesses, and human-in-the-loop controls that let autonomous agents operate safely against a regulated, global pharmaceutical cloud estate.

BASIC QUALIFICATIONS

• Bachelor's Degree in Information Technology, Computer Science, Computer Engineering, or a similar discipline. 

• 6+ years of experience in cloud engineering, cloud security or infrastructure roles. 

• At least 2 years of experience in a technical leadership role, managing or leading engineering teams. 

• Deep expertise in at least one major cloud platform (AWS, GCP, or Azure) with demonstrated familiarity across multiple cloud providers. 

• Strong experience building and deploying cloud infrastructure using industry-standard IaC tools such as Terraform, OpenTofu, or Pulumi. 

• Strong command of cloud security fundamentals: identity and access management, network security, encryption and key management, workload and container security, and logging/monitoring. 

• Proficiency in at least one major programming language (Python strongly preferred) for security automation and tooling. 

• Experience securing or operating enterprise security platforms such as IAM/SSO, identity governance, privileged access management, or SIEM/log analytics. 

• Excellent communicator with the ability to influence horizontally and vertically across a large, complex, and matrixed organization. 

• Strong technical leadership capabilities including the ability to coach, mentor, and develop other engineers. 

• Customer-centric mentality with a bias towards delivering value at the speed demanded by the business. 

• Demonstrated experience in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach. 

PREFERRED QUALIFICATIONS 

• Multi-cloud security experience across AWS, GCP, and Azure. 

• Hands-on experience with Kubernetes / EKS security at scale. 

• Experience with CNAPP / CSPM tooling and with GitHub Advanced Security or equivalent application security tooling. 

• Experience applying AI or agentic tooling to security engineering problems. 

• Experience qualifying cloud services capabilities for use within GxP or other highly regulated environments. 

• Experience with Spacelift or similar IaC automation platforms. 

• Relevant certifications (AWS/Azure/GCP Security Specialty, CISSP, CCSP, OSCP, or equivalent). 

• Curious, self-driven and committed to continuous skill development, particularly around emerging AI security capabilities. 

• Strong problem-solving and analytical mindset, especially for complex cloud systems. 

• Comfortable operating with high ownership and autonomy. 

• Customer-focused mindset with the ability to balance engineering excellence, security and business outcomes.

Please apply by sending your CV in English.

Work Location Assignment: Hybrid

Pfizer endeavors to make www.pfizer.com/careers accessible to all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process and/or interviewing, please email [email protected]. This is to be used solely for accommodation requests with respect to the accessibility of our website, online application process and/or interviewing. Requests for any other reason will not be returned.

To learn more about acceptable and prohibited uses of AI during the recruitment process, please review our candidate AI-use guidelines available on Pfizer Careers.

Information & Business Tech