Security Engineer, Cloud

About the role

Rogo is looking for a hands‑on Security Engineer to lead the design and implementation of cloud security architecture across AWS and GCP. You will own the technical direction of cloud security, building secure primitives, authoring Terraform at scale, and embedding security into the core platform.

Key responsibilities

• Architect and implement cloud security foundations, including account/project structure, IAM models, network segmentation, and secure service‑to‑service communication.
• Author reusable, opinionated Terraform modules for IAM, networking, logging, encryption and enforce policy guardrails.
• Design and operate cloud identity systems at scale, including workload identity, service accounts and cross‑cloud access patterns.
• Lead security design of cloud networking (VPC architecture, private connectivity, egress control, firewalling, isolation).
• Build and maintain security automation in CI/CD pipelines and cloud environments.
• Own Kubernetes and container security for production workloads (GKE/EKS), covering cluster hardening, RBAC, workload identity, image security and runtime controls.
• Define logging, monitoring and detection pipelines to provide high‑signal visibility into cloud security posture.
• Perform threat modeling, architectural reviews and mentor engineers to raise the overall security bar.

Required profile

• Proven experience building cloud security platforms or foundational infrastructure in both AWS and GCP.
• Deep fluency with Terraform, large‑scale state management, module design and safe rollout strategies.
• Strong opinions on cloud IAM and networking design, informed by real‑world incidents.
• Comfort operating in ambiguous environments and defining long‑term technical direction.
• Preference for automation, code and guardrails over manual processes.

Required skills

• AWS
• Google Cloud Platform (GCP)
• Terraform
• Kubernetes (EKS, GKE)
• IAM design
• Network segmentation and VPC architecture
• CI/CD automation
• Policy‑as‑code tools (e.g., OPA)