Senior Cloud Security Engineer

About the role

Roche's cybersecurity team protects the organization's computing environments and is expanding its focus from enterprise endpoint protection to cloud-native environments. It is looking for a Senior Cloud Security Engineer specializing in Cloud Workload Protection, responsible for securing IaaS, PaaS, containers and serverless architectures. The role works alongside senior endpoint security colleagues to extend threat detection and application governance standards to the cloud.

Key responsibilities

• Architect, deploy and manage Cloud Workload Protection Platforms (e.g. Prisma Cloud, Microsoft Defender for Cloud, Wiz or Aqua) across a multi-cloud environment (AWS, Azure and/or GCP)
• Implement runtime defense, vulnerability scanning and configuration hardening for containerized applications and orchestration platforms (EKS, AKS, GKE)
• Adapt existing EDR and Application Control strategies to work effectively in ephemeral, cloud-native workloads
• Embed security controls into CI/CD pipelines (shift-left) so images, registries and IaC templates are scanned before deployment
• Develop automated response playbooks for cloud misconfigurations and workload alerts using serverless functions and native cloud APIs

Required profile

• Bachelor's degree in Computer Science, Software Engineering, Cybersecurity or equivalent practical experience
• 3+ years of experience securing public cloud workloads, with a strong understanding of the shared responsibility model
• Proven hands-on experience deploying and tuning commercial or open-source cloud security platforms (CWPP / CNAPP)
• Strong grasp of cloud-native networking (VPCs, Security Groups) and identity and access management (least-privilege roles, service accounts)
• Proficiency in written and spoken English (C1 or above)
• Ability to collaborate with DevOps and Cloud Engineering teams, adapt on-premise security policies to the cloud, mentor senior endpoint engineers and work in a dynamic cybersecurity environment

Required skills

• Docker and Kubernetes, including securing pods, restricting container privileges and managing network policies
• Cloud security platforms such as Prisma Cloud, Microsoft Defender for Cloud, Wiz or Aqua
• CI/CD pipeline integration and serverless automation