Cleo is seeking a Lead Cloud Security Engineer to design, implement, and continuously improve security controls across our cloud infrastructure and SaaS environments. This role is responsible for strengthening Cleo's AWS security posture, embedding secure-by-default cloud guardrails, and partnering closely with Platform and Engineering teams to reduce infrastructure risk without slowing innovation. The ideal candidate is hands-on, technically deep in AWS, and experienced in building scalable cloud security capabilities in a high-growth SaaS environment. What You Will Be Doing Cloud Security Architecture - Design and implement secure cloud architecture patterns - Establish guardrails for AWS accounts and services - Strengthen multi-account strategy and segmentation - Improve IAM design, permission boundaries, and least-privilege models - Review major infrastructure changes for security impact Cloud Detection and Visibility - Implement and tune cloud-native detection capabilities - Integrate AWS security services into centralized monitoring - Identify misconfigurations and excessive permissions - Improve signal-to-noise ratio in cloud alerts Infrastructure as Code Security - Embed security controls into Terraform or other IaC workflows - Enforce policy-as-code guardrails - Ensure IaC scanning is integrated into CI/CD pipelines - Reduce configuration drift across environments Vulnerability and Configuration Management - Oversee cloud misconfiguration detection and remediation - Track infrastructure vulnerability exposure - Reduce critical vulnerability exposure window - Partner with Platform teams to automate remediation Data Protection and Encryption - Ensure proper encryption standards across storage and databases - Manage KMS usage and key lifecycle best practices - Strengthen logging and monitoring coverage Incident Response Support - Lead cloud-focused investigations during security incidents - Improve forensic readiness in AWS - Harden logging and evidence retention practices Automation and Continuous Improvement - Automate guardrails and enforcement mechanisms - Improve developer experience with secure cloud defaults - Reduce manual cloud security reviews - Optimizing tooling cost and effectiveness Metrics and Reporting - Define KPIs for cloud security posture - Report on misconfiguration trends and exposure windows - Provide executive-level reporting on infrastructure risk - Support audit and compliance evidence collection Your Qualifications Required - 7+ years of experience in cloud security, cloud engineering, or infrastructure security - Deep expertise in AWS architecture and services - Strong understanding of IAM design and least-privilege principles - Experience with Infrastructure as Code and CI/CD integration - Experience implementing cloud-native detection and monitoring - Ability to translate infrastructure risk into business impact Preferred - Experience in mid-market or high-growth SaaS environments - Experience supporting SOC 2 or similar audits - Familiarity with policy-as-code frameworks - Experience building multi-account AWS environments - Relevant certifications such as AWS Security Specialty, CISSP, or equivalent A few things we have to offer: - $130,000 to $150,000 base salary + bonus opportunity - Great Healthcare + Dental + Vision - Flexible PTO - Culture of support, encouraging Life-Work balance - 401k match - FSA and HSA options - Employee Assistance Program - Paid Parental Leave - Representing a company with 4,000+ clients and a 99% retention rate - Accelerated title and salary growth potential - A fun and energetic work environment that makes you excited to go to work every day

• Design and maintain cutting-edge security technologies including SIEM (Sumo Logic), EDR solutions like CrowdStrike, and Zero Trust architecture • Develop smart detection rules and dashboards that catch the bad guys while keeping false alarms to a minimum • Design and implement security controls for GCP, including IAM, VPC security, data protection, threat monitoring, and regulatory compliance • Integrate security monitoring across our entire tech stack - from endpoints to cloud services • Partner with our SOC team to enhance threat detection and make incident investigations more effective • Implement Zero Trust security using Palo Alto Prisma/GlobalProtect to secure our remote access and network protection • Support data protection initiatives and DLP solutions to safeguard our most sensitive information

• Work on problems ranging from cryptography and networking to security automation and AI agents. • Collaborate throughout the Engineering team on the full product lifecycle from reviewing RFDs for proposed designs, code review, vulnerability testing, and documentation. • Work with detection and response stack to stop breaches, solving for false positives, detection coverage, and response automation by writing code and building AI agents.

• Provide research and administrative support to the Center for Peace and Security in the Middle East. • Gather and analyze data for inclusion in reports and articles. • Write literature reviews using gathered data. • Keep the expert and team up to date on current events. • Assist the expert with research projects and presentations. • Assist with articles, op-eds, reports, and briefing memos. • Create databases of department contacts. • Assist with administrative tasks and event support.