Cloud Security Specialist

What You’ll Be Doing

As a key member of the Exposure Management team, you will own the security posture of our hybrid and multi-cloud environment (Azure, AWS, GCP). The role combines hands-on vulnerability management using enterprise vulnerability management (VM) tools with cloud posture and exposure management capabilities delivered through a cloud-native application protection platform (CNAPP). You will be the first responder when emerging threats appear. You will automate workflows from detection through remediation, prioritize by risk, and work closely with Cloud, DevOps, Infrastructure and Application teams to make sure findings get fixed and not just reported.

During a Typical Day, You’ll

• Run end-to-end vulnerability management using enterprise VM tools across on-premises, cloud and hybrid assets. This includes scan configuration, coverage validation, asset tagging, risk assessment and false-positive tuning.
• Oversee cloud security posture through CNAPP capabilities. Triage issues, toxic combinations and attack paths across cloud workloads, containers and serverless functions.
• Drive exposure management by bringing vulnerability, misconfiguration, identity and internet-exposure data into a single risk-ranked view. Prioritization is based on exploitability (CISA KEV, EPSS, threat intelligence) and business criticality, not CVSS alone.
• Lead emerging threat response for critical and zero-day vulnerabilities. You will assess exposure within hours, build targeted vulnerability queries and CNAPP searches, issue advisories, and coordinate emergency remediation with asset owners until findings are closed.
• Identify misconfigurations and vulnerabilities and govern their remediation, tracking ownership, SLAs and exceptions through the ticketing workflow.
• Build security controls, guardrails and automation for cloud platforms. Use Python and PowerShell with APIs from VM and CNAPP tools to automate reporting, ticket creation, enrichment and fix validation.
• Track and report KPIs for cloud posture and vulnerability management, including SLA compliance, mean time to remediate, scan coverage and risk trend. Reports go to both operational and leadership audiences.
• Identify and assess cloud-related risks through continuous monitoring and threat modeling, and govern their mitigation.
• Verify adherence to frameworks such as SOC 2, FedRAMP, ISO 27001, NIST, PCI DSS, HIPAA and CIS Benchmarks, and confirm that security controls are implemented and working as designed.
• Manage CSPM, CWPP and CNAPP tooling, integrate it into operational workflows, and maintain connector health and coverage.
• Collaborate with cloud providers, tool vendors, internal teams and external auditors.

What You Bring to the Role

• 5-7 years of experience in vulnerability management and cloud security, including proven involvement in emerging threat response.
• Strong hands-on expertise with enterprise vulnerability management tools, including scan design, asset-tagging strategy, dashboards, policy and compliance assessment, and API usage.
• Strong hands-on expertise with CNAPP capabilities, including issue triage, rule tuning and remediation governance.
• Practical understanding of exposure management (CTEM), risk-based prioritization, and scoring frameworks such as CVSS, EPSS and CISA KEV.
• Hands-on experience with Azure, AWS or GCP security services and their native posture tooling.
• Experience with container and Kubernetes security, including image scanning and container workload protection.
• Strong understanding of networking, encryption, IAM and cloud-native architectures.
• Knowledge of threat modeling and secure design patterns.
• Ability to explain technical risk clearly to both engineering teams and leadership.

Add-on Skills

• Python and PowerShell scripting for security automation, API integration and data analysis.
• Automation of vulnerability and posture workflows, including ticketing, reporting, enrichment and integration with CI/CD pipelines.
• Infrastructure as Code (IaC) security and policy-as-code concepts.
• Familiarity with serverless security and microservices.

Preferred Certifications

• Relevant certifications in vulnerability management, cloud security or exposure management are a plus.
• AZ-500 Azure Security Engineer, AWS Security Specialty, GCP Professional Cloud Security Engineer, or CCSP.