[Hiring] Principal Cloud Security Engineer @HealthEquity

Role Description

As a Principal Cloud Security Engineer, Product Security, you provide technical leadership for the security of the cloud environments that host HealthEquity's products and platforms. You design the posture management, policy-as-code guardrails, and automated controls that keep misconfigured and overexposed resources out of production across our environments.

You combine hands-on cloud engineering with sound architectural judgment. Your application security and threat modeling background keeps those controls tied to how HealthEquity's products are built and how they could be attacked.

• Lead the architecture and ongoing evolution of cloud security posture management across a large multi-subscription estate.
• Design and build policy-as-code preventive guardrails, including service control policies, Azure Policy, and infrastructure-as-code validation in CI/CD.
• Own the security architecture for cloud landing zones and account and subscription provisioning.
• Build event-driven auto-remediation that enforces security and compliance baselines at scale.
• Lead network exposure reduction for customer-facing applications.
• Define and evolve the IAM strategy for Azure, AWS, and GCP.
• Lead threat modeling and architecture reviews for high-risk, cloud-hosted products and migrations.
• Partner with Application Security and Vulnerability Management to build code scanning and software supply chain controls.
• Establish security guardrails, governance requirements, and secure-adoption policy for AI services.
• Set technical direction, identify systemic risks, recommend strategic improvements, and mentor security engineers.

Qualifications

• Deep, hands-on experience securing production cloud environments at enterprise scale.
• Extensive experience architecting, building, and operating cloud security controls in production AWS and Azure environments.
• Deep experience with CNAPP/CSPM platforms for posture management and risk-based prioritization.
• Advanced proficiency with policy-as-code and preventive guardrails.
• Strong working knowledge of AWS and Azure native security services.
• Experience designing and operating event-driven automated remediation.
• Strong understanding of cloud network security.
• Proficiency in Python, PowerShell, and Bash for security automation.

Requirements

• Advanced knowledge of cloud identity and access management.
• Strong foundation in application security.
• Experience building vulnerability management and software supply chain programs.
• Working knowledge of the security risks of AI and LLM technologies.
• Hands-on understanding of penetration testing and offensive security findings.

Experience & Background

• 12+ years of experience in cloud security, security engineering, or application security.
• Demonstrated experience architecting, delivering, and operating security solutions.
• Experience serving as a technical lead and mentoring engineers.
• Ability to influence technical direction and explain complex risks to various audiences.
• Exceptional judgment in balancing security requirements with engineering practicality.

Preferred Qualifications

• Experience defining and scaling security capabilities within CI/CD pipelines.
• Experience designing and operating a bug bounty or vulnerability disclosure program.
• Experience in healthcare, financial services, or another highly regulated industry.
• Strong working knowledge of HIPAA, SOC 2, NIST Cybersecurity Framework, or similar frameworks.
• Relevant industry certifications such as AWS Certified Security - Specialty, Microsoft Azure security certifications, CCSP, CISSP, or comparable credentials.

Benefits

• Medical, dental, and vision.
• HSA contribution and match.
• Dependent care FSA match.
• Uncapped paid time off.
• Paid parental leave.
• 401(k) match.
• Personal and healthcare financial literacy programs.
• Ongoing education & tuition assistance.
• Gym and fitness reimbursement.
• Wellness program incentives.