Principal Cloud Security Engineer

• Lead the architecture and ongoing evolution of cloud security posture management across a large multi-subscription estate, using CNAPP/CSPM tooling to surface public exposure, misconfiguration, and risk, and driving prioritized remediation with product and platform teams.
• Design and build policy-as-code preventive guardrails, including service control policies, Azure Policy, and infrastructure-as-code validation in CI/CD, that block non-compliant infrastructure before it reaches production while applying defense-in-depth.
• Own the security architecture for cloud landing zones and account and subscription provisioning, so that newly created environments inherit security baselines, guardrails, and logging by default.
• Build event-driven auto-remediation that enforces security and compliance baselines at scale, and define when automated action is appropriate and when human review is required.
• Lead network exposure reduction for customer-facing applications, including web application firewall rule management, tighter security group and network security group ingress, and a move toward private connectivity.
• Define and evolve the IAM strategy for Azure, AWS, and GCP including federated identity, standardized SSO, least privilege, conditional access, and reduction of standing privilege.
• Lead threat modeling and architecture reviews for high-risk, cloud-hosted products and migrations, and scope and coordinate third-party penetration tests and audits, translating findings into prioritized remediation plans for engineering and executive stakeholders.
• Partner with Application Security and Vulnerability Management to build code scanning, secret detection, dependency analysis, and software supply chain controls into developer workflows and release gates, and support external researcher and bug bounty programs through scope, triage, and remediation SLAs.
• Establish security guardrails, governance requirements, and secure-adoption policy for AI services and AI-enabled development tooling in cloud environments, including managed model guardrails and Model Context Protocol (MCP) security.
• Set technical direction, identify systemic risks, recommend strategic improvements, and mentor and guide security engineers while driving the evolution of team tools, practices, standards, and automation capabilities.

What you will need to be successful

This role requires deep, hands-on experience securing production cloud environments at enterprise scale, combined with the architectural judgment that comes from an application security background and the ability to provide technical leadership across teams.

Experience & Background

• 12+ years of experience in cloud security, security engineering, application security, or a closely related discipline, including significant time securing production cloud environments.
• Demonstrated experience architecting, delivering, and operating security solutions with broad organizational impact across a large cloud estate and many development teams.
• Experience serving as a technical lead and mentoring engineers, and leading initiatives across cross-functional engineering and security teams without relying on direct authority.
• Ability to influence technical direction and clearly explain complex risks, tradeoffs, and findings to technical and non-technical audiences, including senior leaders.
• Exceptional judgment in balancing security requirements with engineering practicality, business needs, and long-term platform strategy.

• Experience defining and scaling security capabilities within CI/CD pipelines and developer workflows.
• Experience designing and operating a bug bounty or vulnerability disclosure program.
• Experience in healthcare, financial services, or another highly regulated industry.
• Strong working knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar regulatory and security frameworks.
• Relevant industry certifications such as AWS Certified Security - Specialty, Microsoft Azure security certifications, CCSP, CISSP, or comparable credentials.

This is a remote position.

• Extensive experience architecting, building, and operating cloud security controls in production AWS and Azure environments, including multi-account and multi-subscription estates.
• Deep experience with CNAPP/CSPM platforms for posture management, exposure and attack-surface management, and risk-based prioritization of findings.
• Advanced proficiency with policy-as-code and preventive guardrails, such as SCPs, AWS Config rules, CloudFormation Guard, Azure Policy, and security validation of infrastructure-as-code (CloudFormation, CDK) within CI/CD pipelines.
• Strong working knowledge of AWS and Azure native security services, including Control Tower, Organizations, Security Hub, GuardDuty, Defender for Cloud, Sentinel, and cloud WAF and firewall services.
• Experience designing and operating event-driven automated remediation and detection that enforces security baselines across a cloud estate.
• Strong understanding of cloud network security, including security groups and NSGs, WAF, API gateways, and private connectivity patterns.
• Proficiency in Python, PowerShell, and Bash for security automation and tooling.

• Advanced knowledge of cloud identity and access management, including federated identity, SSO, SAML, OAuth 2.0, OIDC, least privilege, and conditional access.
• Strong foundation in application security, including threat modeling (STRIDE, attack trees), architectural security reviews, secure code review, OWASP Top 10, and CWE Top 25.
• Experience building vulnerability management and software supply chain programs, including SAST, secret scanning, software composition analysis, and triage and prioritization workflows that give developers actionable feedback.
• Working knowledge of the security risks of AI and LLM technologies, including model guardrails, MCP, and AI-assisted development tools, and the controls needed to adopt them safely.
• Hands-on understanding of penetration testing and offensive security findings sufficient to scope engagements, evaluate results, and drive remediation.

Salary Range

$159000.00 To $210500.00 / year

Benefits & Perks

The actual compensation offer is determined based on job-related knowledge, education, skills, experience, and work location. This position will be eligible for performance-based incentives and restricted stock units as part of the total compensation package, in addition to a full range of benefits including:

• Medical, dental, and vision
• HSA contribution and match
• Dependent care FSA match
• Uncapped paid time off
• Paid parental leave
• 401(k) match
• Personal and healthcare financial literacy programs
• Ongoing education & tuition assistance
• Gym and fitness reimbursement
• Wellness program incentives

Why work with HealthEquity

HealthEquity has a vision that by 2030 we will make HSAs as wide-spread and popular as retirement accounts. We are passionate about providing a solution that allows American families to connect health and wealth. Join us and discover a work experience where the person is valued more than the position. Click here to learn more.

You belong at HealthEquity!

HealthEquity uses Microsoft Copilot to transcribe screening interviews between candidates and their direct Talent Partner for note taking and interview summaries. By scheduling a screening interview with us, you consent to Microsoft Copilot’s AI technology recording and transcribing your interview with your Talent Partner. This information will be reviewed for accuracy and then used by HealthEquity to summarize the interview, ensure accuracy, and facilitate our hiring process.

We take privacy seriously. You have the option to opt out. If you wish to opt out of this Microsoft Copilot transcription, please notify your Talent Partner in advance of the interview. If we do not receive an opt-out request from you, we will assume that you consent to the use of Microsoft Copilot.

HealthEquity uses Pindrop Pulse during certain interviews to support identity verification, interview security, and fraud prevention. By scheduling and participating in an interview where Pindrop Pulse is enabled, you acknowledge that Pindrop's technology may analyze information such as voice, video, device, network, and location-related signals to identify potential impersonation, deepfake activity, and other security risks. This information may be reviewed by HealthEquity's Talent Acquisition and Security teams to support a secure hiring process.

All alerts and risk indicators are reviewed by trained personnel, and HealthEquity does not make hiring decisions based solely on automated analysis. We take privacy seriously. You have the option to opt out of Pindrop analysis. If you wish to opt out, please notify your Talent Partner in advance of the interview. If we do not receive an opt-out request from you before the interview, we will assume that you consent to HealthEquity's use of Pindrop Pulse for security verification purposes during the hiring process.

Our Mission

Our mission is to SAVE AND IMPROVE LIVES BY EMPOWERING HEALTHCARE CONSUMERS. Come be part of remarkable.

Overview

How you can make a difference

As a Principal Cloud Security Engineer, Product Security, you provide technical leadership for the security of the cloud environments that host HealthEquity's products and platforms. Reporting to the VP, Head of Product Security, you design the posture management, policy-as-code guardrails, and automated controls that keep misconfigured and overexposed resources out of production across our environments.

You combine hands-on cloud engineering with sound architectural judgment. You define cloud security standards and reference architectures, build preventive and detective controls as code, and work with product and platform engineering teams so that secure patterns are the default path rather than a late-stage review. Your application security and threat modeling background keeps those controls tied to how HealthEquity's products are built and how they could be attacked.

The standards, guardrails, and automation you establish reduce public attack surface, shorten the time from detection to remediation, and let engineering teams deliver securely with less manual effort, in support of HealthEquity's responsibility to protect member data.