Senior Principal, Cloud Engineering

Department: Cloud Platform

Employment Type: Permanent

Location: UK, Remote

Description

Responsibilities

• Design, implement and maintain AWS security controls across IAM, networking, encryption, logging, account governance and guardrails.
• Implement and maintain AWS-native security services and governance patterns, including AWS Organizations, Control Tower, Service Control Policies, IAM Access Analyzer, Security Hub, GuardDuty, Inspector, Config, CloudTrail, KMS and centralised logging where applicable.
• Harden AWS accounts, services and workloads against CIS Benchmarks and Forterro security baselines, including documented exception and waiver processes for product-specific differences.
• Translate security requirements into infrastructure-as-code, policy-as-code and reusable automation modules that can be deployed consistently across multiple products and environments.

• Own the reliable deployment, configuration and operational health of security tooling across cloud and workload environments.
• Ensure CrowdStrike Falcon endpoint and cloud workload protection is deployed, healthy, version-compliant and reporting correctly, including failed agent deployment remediation and coverage reporting.
• Ensure Tenable scanning coverage is complete and reliable across cloud assets, with remediation workflows, exception handling and evidence reporting agreed with the Security team.
• Operate and improve ManageEngine-based patch tooling and workflows, ensuring patch automation, compliance reporting, failure handling and maintenance windows are clear and repeatable.
• Troubleshoot failed security-tool deployments and configuration drift across IAM, networking, Kubernetes, host agents, APIs, CI/CD and platform automation.

• Operationalise vulnerability and patch management processes across the AWS estate, ensuring scan coverage, triage, remediation ownership and closure tracking are measurable.
• Define, automate and report patch SLAs based on severity, asset criticality and business impact, including exception handling, rollback evidence and stakeholder communication.
• Work with Security to prioritise risk and with CloudOps/Product teams to execute remediation safely through approved change-control processes.
• Create dashboards and reports for patch compliance, vulnerability ageing, failed deployments, risk acceptance and remediation trends.

• Implement, maintain and audit Fortinet firewall controls, including rule sets, segmentation, VPNs, policy reviews and configuration validation under change control.
• Manage and validate Cloudflare services including WAF, DNS, CDN, DDoS protection and Zero Trust / access policies, using configuration-as-code where practical.
• Partner with Security on policy intent while ensuring configuration is implemented accurately, tested and operationally supportable.

• Secure and harden Kubernetes clusters, including Amazon EKS, RBAC, network policies, admission controls, secrets management, runtime controls and image provenance.
• Integrate container image scanning, registry scanning, software composition analysis, secrets scanning and SBOM generation into CI/CD and runtime processes.
• Establish and enforce baseline configurations and CIS Kubernetes Benchmark compliance using policy-as-code tooling such as OPA/Gatekeeper or Kyverno where appropriate.
• Secure AWS Lambda and event-driven serverless services through least-privilege execution roles, dependency and code scanning, runtime monitoring, event-source control and API Gateway/WAF guardrails.

• Implement and maintain infrastructure-as-code and automation using Terraform, Crossplane, CloudFormation where required, Ansible, Helm, Python, Bash/PowerShell and YAML.
• Integrate security controls into GitLab CI/CD and GitOps workflows such as ArgoCD, including SAST, SCA, secrets scanning, IaC scanning, container scanning, policy gates and exception workflows.
• Automate routine security operations including scanning, patch orchestration, configuration drift detection, evidence gathering and compliance reporting.
• Convert repeatable runbooks into idempotent automation and reusable deployment patterns that CloudOps and product teams can consume safely.

• Create clear runbooks, operational acceptance criteria, handover packs, service documentation, diagrams and support guidance for CloudOps and product teams.
• Define and maintain a practical RACI for security tooling deployment and operation, reducing ambiguity between Security, Platform, CloudOps and product teams.
• Participate in incident response and post-incident reviews where security tooling, control failures, vulnerability exposure or patch failures are involved.
• Mentor engineers on secure practices and support continuous improvement across Platform Engineering, CloudOps and product delivery teams.
• Evaluate new security technologies and products, produce evaluation reports, and recommend improvements aligned to business risk and SaaS platform strategy.

Skills, Knowledge & Expertise

• 5+ years of hands-on experience in DevSecOps, Cloud Security Engineering, Platform Engineering, SRE or senior cloud engineering roles.
• Strong working knowledge of AWS security architecture and services, including IAM, networking, encryption, logging, Organizations/SCPs, Security Hub, GuardDuty, Inspector, Config, CloudTrail and KMS.
• Practical experience deploying, configuring or operating security tools such as CrowdStrike, Tenable, ManageEngine, Fortinet firewalls and Cloudflare.
• Strong experience with infrastructure-as-code, GitOps and CI/CD tooling such as Terraform, CloudFormation, Ansible, Helm, ArgoCD, GitLab CI/CD and Git.
• Proficiency with scripting and automation using Python, Bash, PowerShell and YAML.
• Experience securing Kubernetes/EKS, container platforms and serverless workloads, including RBAC, network policies, admission controls, image scanning, secrets management and runtime monitoring.
• Solid grasp of vulnerability management, patch management, risk-based remediation, change control, SLAs and compliance evidence.
• Hands-on ability to troubleshoot failed automation, configuration drift and deployment failures across cloud, network, endpoint, Kubernetes and CI/CD layers.
• Experience operating in a multi-team, multi-product SaaS or enterprise cloud environment.
• Excellent communication, stakeholder management and ownership mindset, with the ability to reduce ambiguity between Security, Platform, CloudOps and product teams.

• Relevant certifications such as AWS Certified Security - Specialty, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP, GIAC, Terraform Associate or equivalent experience.
• Experience with SIEM/SOAR platforms, security incident response and threat-informed remediation.
• Familiarity with compliance frameworks such as ISO 27001, SOC 2, NIST and CIS.
• Experience implementing policy-as-code 
• Experience in SaaS platform standardisation, shared services, mergers/acquisitions integration or multi-account AWS governance.