The Senior Cloud Security Engineer owns the defence and detection of Cognism's cloud environment, reporting to the Director, Security Engineering & Operations. As the senior technical voice on cloud security, you will lead on the development of our cloud security roadmap, and support and mentor the other cloud security engineers on the team. AWS is at the core, but the estate also spans SaaS and managed services: source control, edge and networking, databases, data streaming and messaging, and secure access.

As we move from software to infrastructure that customers and their AI agents depend on, our attack surface grows: more APIs, an MCP connector, and data pipelines feeding our proprietary data engine. You will be the engineer who knows which threats matter most to Cognism's cloud infrastructure,  and who builds the controls, detections and automation that stop them.

This is a hands-on, blue-team role where automation is the default and AI is a force multiplier. You would rather write the code that closes a gap than raise a ticket about it, and you use AI wherever it genuinely speeds up triage, detection engineering, investigation or remediation. You will work closely with Platform, Data Engineering, IT and our 24/7 SOC partner, as a partner to engineering, not a gatekeeper. 

 

 

WHAT YOU'LL OWN 

Cloud Security Roadmap & Controls 

• Lead our cloud security roadmap: assess where we are exposed, recommend priorities by threat and business impact, agree the plan with the Director and Engineering leaders, and execute or support on delivery. 

• Work with the Platform team to harden our AWS environment across all accounts, and the other technologies that protect our cloud infrastructure, monitoring continuously for misconfiguration and drift. 

• Advise the Director of IT Ops on hardening and monitoring our corporate cloud infrastructure, with IT owning day-to-day operation. 

• Partner with the Director of IT Ops and our Platform team on our EDR platform, as our MDR provider, runs detection and response, and IT and Platform own deployment. Security ensures the configuration is right, including policies, exclusions and response settings, and that coverage across endpoints and servers has no gaps. 

• Stay highly threat-aware: understand Cognism's highest threats, and recommend and embed the controls that mitigate them, prioritising by real-world impact and exploitability rather than coverage. 

• Govern the patch management process for cloud workloads, containers and infrastructure, from scanning and risk-based prioritisation through to verified closure. 

• Review major architecture changes with Platform and Engineering, building guardrails into pipelines rather than relying on manual review of changes. 

• Partner with our Identity and Access Management expert, to govern the access model for our cloud and engineering systems: design how identity and authorisation work across the estate, with preventive guardrails that enforce least privilege by default. 

• Work with Data Engineering to ensure our data infrastructure is secure, covering how we ingest, process, access and surface data. 

• Partner with the Senior Application Security Engineer so that cloud, API and application controls reinforce each other. 

 

 

Logging, Detection, Response & SOC Partnership 

• Ensure all critical infrastructure is logged and monitored by our 24/7 SOC. Own log ingestion and logging configuration across cloud and application sources, so the SOC gets the right data with the right coverage, quality and retention. 

• Act as the main technical partner to the SOC: give them the business and environment context they need to tune detections and response, review alert quality with them, and keep improving how we detect, triage and respond together. 

• Partner with the rest of the security engineering team and our 24/7 SOC to automate response to infrastructure and identity-related incidents, using AI where it genuinely speeds up triage, enrichment or remediation. 

• Lead investigation and containment for cloud and identity incidents, with the SOC and wider security team covering the rest, and turn post-incident reviews into new controls. 

 

Automation & AI-Enabled Security Engineering 

• Make automation the default: infrastructure-as-code, detection-as-code, policy-as-code, automated remediation and self-serve guardrails. 

• Use AI tooling to do more with less, in triage, detection authoring, investigation and vulnerability analysis. Measure what works, and retire what doesn't. 

• Help the team build safe, repeatable patterns for using AI in security operations. 

 

Compliance & Evidence 

• Own the ISO 27001 and SOC 2 Type II evidence for the controls you build and run, so it is ready rather than collected at the last minute. 

 

 

WHAT WE NEED 

Technical foundation 

• Strong AWS security skills: multi-account guardrails, IAM policy design, network security, encryption and the native security services. 

• Strong automation skills: Python or similar, Terraform and CI/CD, and hands-on experience using AI tooling to do more with less. 

• Hands-on experience working with a SOC on log source onboarding, alert tuning and response automation. 

• Familiarity with EDR/MDR platforms, including reviewing policy and configuration. 

• Solid incident response fundamentals in cloud environments. 

• Working understanding of how APIs and agent-facing interfaces (such as MCP) are attacked, and which controls reduce that risk. 

• Practical understanding of data platform security: how data is ingested, processed, accessed and surfaced securely. 

 

Collaboration & influence 

• Support and develop the other cloud security engineers: set technical standards, review designs and detections, share context on priorities, and help them grow. 

• Partner to Platform, Data Engineering, IT and the SOC: you earn trust by making the secure path the easy path, not by raising blockers. 

• Able to explain threats and trade-offs clearly to engineers, IT leaders and non-technical stakeholders. 

• Comfortable giving the SOC and engineering teams the context they need, and holding them to account on outcomes. 

 

Mindset 

• Threat-aware and risk-based: you can tell a theoretical risk from a real business threat, and prioritise by impact and exploitability, not CVSS score alone. 

• Automation-first: you default to code, guardrails and automated response over manual process and tickets. 

• Curious about AI: you see it as both a new threat landscape and a way to make security faster and smarter. 

• Pragmatic bias toward action: you sequence work sensibly, ship, learn and improve. 

• Ownership: you own your controls end to end, from design to evidence. 

 

 

WHAT SUCCESS LOOKS LIKE 

• A prioritised, threat-led cloud security roadmap is agreed with Security leadership and Engineering and is being delivered, and the other cloud security engineers are clear on priorities and growing in capability. 

• AWS guardrails are in place across all accounts, and drift is measured rather than guessed at. 

• Our highest threats are mapped to controls and SIEM detections, and the gaps are visible and being closed. 

• Critical infrastructure is logged and monitored by the SOC. The log coverage gaps that matter are closed, and SOC alert noise is noticeably lower. 

• Common infrastructure and identity incidents are handled by automated response. 

• CrowdStrike is correctly configured and covers the whole estate, with IT, Platform and Security clear on who owns what. 

• Data infrastructure controls are agreed and embedded with Data Engineering. 

• AI is used in day-to-day security work with a measurable effect, such as faster triage or less manual effort. 

• The controls you own pass ISO 27001 and SOC 2 audits, with evidence ready rather than collected at the last minute. 

 

 

EXPERIENCE 

Typical background 

Area	What we look for
Cloud and AI security	7+ years in Cloud Security Engineering, with at least 4 years securing AWS in production, and experience mentoring or technically leading other engineers.   Experience with Securing AI/ML-enabled services, APIs or MCP-style integrations.
Automation	Python or similar, Terraform and CI/CD, with experience using AI tooling to automate security work
Detection & SOC	Hands-on SIEM and log analytics, alert tuning, and working with a SOC or MSSP
Endpoint	Familiarity with EDR/MDR platforms such as CrowdStrike, including configuration review
Incident response	Cloud incident response fundamentals
Environment	SaaS or high-growth, data-driven company, working with Platform, Data and IT teams
Compliance context	Enough ISO 27001 and SOC 2 familiarity to own evidence for your controls

 

 

Nice to have 

• Kubernetes/EKS and container security. 

• Threat hunting or purple teaming. 

• Experience with data platform security (pipelines, warehouses, streaming). 

• Experience with AI-powered engineering tools such as Claude Code, Cursor or GitHub Copilot. 

• Certifications such as AWS Certified Security – Specialty, GCIH or GCFA.