Want to know if this job is worth applying to?
San Francisco, California, United States
Onsite
Arena is the platform for evaluating how AI models perform in the real world. Founded by researchers from UC Berkeley's SkyLab, we're on a mission to measure and advance the frontier of AI for real-world use, and to build the foundation for everyone to understand, shape, and benefit from it.
Tens of millions of people use Arena each month to evaluate how frontier systems handle the work they actually do. The preferences they share power the most transparent, rigorous, and human-centered evaluations in AI. Leading AI labs, enterprises, and independent researchers rely on our work and open datasets to understand how models behave in real workflows: agentic coding, creative generation, professional productivity, and beyond. We go beyond leaderboards and decompose what human experience reveals about AI, so models advance toward the work people actually do.
We're a team of researchers, academics, builders, and creatives from UC Berkeley, Google, Stanford, and DeepMind. We seek truth, move fast, and value craftsmanship, curiosity, and impact over hierarchy. We're building a company where thoughtful, curious people from all backgrounds can do their best work together, in an office culture that radiates excellence, energy, and focus.
We are looking for a staff-level cloud security engineer to build and improve the controls that protect Arena's cloud infrastructure. You will set how workloads prove who they are, where machine credentials live and how they rotate, what our services can reach, and how we know when something is wrong. Then you will build the controls that enforce it, in code.
This is a hands-on seat. You will do the work, not direct it from a distance.
Our engineers build on cloud and managed platforms for hosting, data, workflows, source control, and builds. You will set the security requirements for workload identity, machine credentials, and cloud access across them.
You'll work closely with platform, infrastructure, and product engineers to set cloud security requirements and build controls into the infrastructure they run.
This role is onsite in our San Francisco office and reports to the Head of Security.
Design the cloud identity model for workloads, not just administer it. Least-privilege IAM, workload identity federation, and short-lived credentials. You decide what a workload can do and how it proves who it is.
Own machine secrets and rotation end to end. Every machine credential has an owner, a home in a central secret manager, and a rotation path that has been run, so rotating a key is routine and doesn't take the product down.
Set the rules for what each environment and service may reach, including limits on outbound connections, separation between environments, and the boundaries around agent runtimes.
Build security detections and alerts for high-risk changes to cloud infrastructure and build systems, and write response steps a colleague can follow without you.
Build cloud security checks into infrastructure code and build pipelines, so the secure path is the easiest one.
Secure the machine credentials and permissions used by source control, build pipelines, and cloud deployments.
Assess the technical access requested by vendors and managed platforms before onboarding.
Lead technical response to cloud infrastructure security events, working with the affected teams through recovery.
Keep cloud security posture visible to engineering and leadership, and improve it continuously.
Share the security on-call rotation.
6+ years in security or infrastructure engineering, with at least 3 focused on cloud security in production.
Deep, current, hands-on experience securing AWS, GCP, and Cloudflare. You can describe what you built or configured in the last three months at keyboard level.
You have owned cloud security somewhere, not just worked a findings queue. You have made calls about how IAM and secrets should work, defended them, and lived with what they cost. You can name one you got wrong and changed.
Real depth in workload identity. OIDC, workload identity federation, IAM design, and secret managers. You can explain how a workload proves who it is without a stored key.
Rotation you have actually run. You can walk through rotating a production database or API credential without an outage, and what you would do differently next time.
Detection and response in the cloud. You have written detections, been paged by them, and investigated a real event from cloud audit logs.
Comfort in Terraform or a similar infrastructure-as-code tool, and in at least one language for automation such as Python, Go, or TypeScript.
Experience securing build pipelines and CI/CD, such as GitHub Actions and deployment credentials.
Hands-on with AI tooling in your own work. You use AI to build, script, and investigate, and you know where it belongs in a security workflow and where it doesn't.
Judgment about risk. You can tell a real exposure from a theoretical one, and say plainly which is which.
Comfort improving existing systems and documentation while keeping work moving.
Securing serverless platforms such as Vercel
Securing infrastructure for AI agent runtimes or sandboxed code execution
Kubernetes security, Postgres access controls, or data platform security such as Databricks
Leading incident response in a cloud environment
Compliance evidence work for cloud controls: SOC 2 or ISO 27001
Experience as an early security hire at a fast-growing startup
Experience working with data protection requirements in logs and access controls
We offer competitive compensation aligned to the markets where our team members are based. The compensation range for each role is listed on its posting and will depend on the candidate's experience and work location.
Comprehensive health and wellness benefits, including medical, dental, vision, and additional support programs.
The opportunity to work on cutting-edge AI with a small, mission-driven team
A culture that values transparency, trust, and community impact
Come help build the space where anyone can explore and help shape the future of AI.
Arena Intelligence provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, genetics, sexual orientation, gender identity, or gender expression. We are committed to a diverse and inclusive workforce and welcome people from all backgrounds, experiences, perspectives, and abilities.
