# Staff Engineer, Cloud Security

**Company**: Toast
**Location**: Remote, US
**Work arrangement**: remote
**Experience**: staff
**Job type**: full-time
**Salary**: Zone A: $193,000-$309,000 USD, Zone B: $168,000-$269,000 USD, Zone C: $151,000-$242,000 USD
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/toast/jobs/8267000?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_34e4db5b-fdc

## Description

Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.

The Product & Platform Security team at Toast protects the cloud infrastructure and services that restaurants depend on every day. We are looking for a Staff Engineer, Cloud Security to expand the scope and coverage of our cloud security capabilities.

**Responsibilities**

- Own and operate our Cloud-Native Application Protection Platform (CNAPP), including tuning, coverage, integrations, and turning findings into prioritized, actionable work for engineering teams.

- Lead cloud security posture management (CSPM) across our AWS organization and accounts, defining standards and measuring adherence over time.

- Drive identity and access management improvements, including least privilege, role and permission design, and reducing standing access.

- Secure our container environments, from image and workload security to cluster configuration and runtime protection.

- Build guardrails and secure defaults into infrastructure as code and deployment pipelines, so that teams get secure configurations by default rather than through review.

- Perform secure architecture reviews and threat modeling for new and existing cloud services and platform capabilities.

- Partner with our SOC on cloud detection coverage, logging, and investigation readiness.

- Run and improve cloud vulnerability and misconfiguration remediation programs, working with engineering owners to drive risk down.

- Participate in security incident response, including on-call coverage, and lead the cloud side of investigations and follow-up work.

- Set the multi-year direction for cloud security at Toast, and mentor and uplevel other engineers on the team.

- Build trusted relationships with Platform, Infrastructure, and product engineering leaders, and influence their priorities through data and clear risk communication.

**Requirements**

- 8+ years of experience in security engineering, infrastructure, or software engineering, with significant time focused on cloud security.

- Deep, hands-on experience securing AWS environments at scale, including IAM, Organizations, networking, logging, and core security services.

- Experience deploying and operating cloud security tooling, such as CNAPP or CSPM platforms (for example Orca, Wiz, or Upwind).

- Experience with container and Kubernetes security (for example EKS).

- Experience performing threat modeling and security architecture reviews for cloud services and platform capabilities.

- Experience responding to security incidents in cloud environments.

- Proficiency with infrastructure as code (for example Terraform) and in at least one programming language used for automation (for example Python or Go).

- A track record of leading cross-team technical initiatives and influencing engineering teams without direct authority.

- History of setting technical direction for a security domain, including a multi-year roadmap and the decisions behind it.

- Clear written and verbal communication, including explaining risk and tradeoffs to engineers and leaders.

**Nice to Haves**

- Experience with GCP, Azure, or other cloud platforms.

- Experience with cloud detection engineering or incident response in cloud environments.

- Familiarity with compliance frameworks relevant to payments and SaaS, such as PCI DSS or SOC 2.

- Relevant certifications, such as AWS Certified Security Specialty or CCSP.

- Experience mentoring engineers or growing a security function.

## Skills

### Required
- AWS
- Cloud Security
- CNAPP
- CSPM
- Container Security
- Kubernetes
- Terraform
- Python
- Go
- IAM
- Organizations
- Networking
- Logging

### Nice to have
- GCP
- Azure
- Cloud Detection Engineering
- Incident Response
- PCI DSS
- SOC 2
- AWS Certified Security Specialty
- CCSP

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/toast/jobs/8267000?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)