Cloud Security Engineer

Hex is hiring a Cloud Security Engineer to join its security team, working on the security and resilience of its cloud infrastructure. The role involves leading cloud security practices and working closely with the infrastructure and engineering teams to secure cloud-native applications. It is based in the United States.

What you will do

• Design, implement, and manage security solutions and controls for AWS environments and Kubernetes clusters, including isolation and sandboxing methods for Hex's RCE-as-a-Service platform.
• Build, deploy, and maintain infrastructure-as-code using Terraform, enforcing security standards.
• Conduct security assessments, threat modeling, and audits on AWS cloud infrastructure and Kubernetes deployments.
• Work with development and operations teams to embed security practices into CI/CD pipelines.
• Monitor and respond to cloud security incidents, identify root causes, and recommend remediation actions.
• Provide expertise in compliance requirements related to cloud security, such as SOC 2, ISO 27001, GDPR, HIPAA, and PCI DSS.
• Mentor engineers and advocate for cloud security across the organization.

What they are looking for

• 5+ years of experience in cloud security engineering, with extensive expertise in AWS.
• Demonstrated proficiency with Kubernetes security, including cluster hardening, role-based access control (RBAC), network policies, and container vulnerability management.
• Expert-level knowledge and hands-on experience with Terraform.
• Familiarity with AWS security services such as IAM, GuardDuty, Security Hub, CloudTrail, and WAF.
• Familiarity with CNAPP solutions such as Wiz.
• Familiarity with SIEM solutions such as Panther.
• A solid understanding of secure software development lifecycle practices, CI/CD security, and DevSecOps methodologies.
• Certifications such as AWS Certified Security – Specialty, Certified Kubernetes Security Specialist (CKS), and Terraform Associate are highly desirable.
• Bonus points for security certifications from SANS or OffSec.
• Excellent problem-solving, communication, and leadership skills.

Pay and benefits

The salary range for this role is $200,000 to $265,000. Hex offers a total rewards package that includes market-benched salary and equity, health benefits, and flexible paid time off. The salary range shown may reflect factors such as geographical location and the skill ranges or levels Hex is open to. Placement in the range is decided after the interview process, taking into account factors like room for growth, internal fairness and parity, your demonstrated skills, and the depth of your experience. The recruiting team can provide more details during the interview process.

About Hex

Hex's product is a web-based notebook and app authoring platform. The frontend is built with Typescript and React, using Apollo GraphQL and Redux for managing application state and data. On the backend, Typescript powers an Express/Apollo GraphQL server that interacts with Postgres, Redis, and Kubernetes to manage the database and Python kernels. The backend is tightly integrated with infrastructure and CI/CD, using Terraform, Helm, and AWS to deploy and maintain the stack.

The engineering team describes itself as engineers forging new ground together who like partnering with security. Hex's blog covers how the team thinks through problems and learns from mistakes, with posts including "How we took down production…", "Beyond Linear Notebooks", and "A pragmatic approach to live collaboration".

Application notes

By submitting an application, the candidate consents to the use of their personal information in accordance with the Hex Privacy policy. Hex Technologies uses AI-assisted tools as part of its application review process, including for resume screening and fraud detection. These tools help the team evaluate applications and verify applicant information. All AI-generated recommendations are reviewed by a member of the recruiting team before any hiring decision is made. No application is automatically rejected based solely on an AI tool's output.