Senior Security Engineer II

At Braze, we're a genuinely approachable, exceptionally kind, and intensely passionate crew. We seek to ignite that passion by setting high standards, championing teamwork, and creating work-life harmony as we collectively navigate rapid growth on a global scale while striving for greater equity and opportunity – inside and outside our organization.

We're looking for a Senior Cloud Security Engineer II to join our Security Engineering function as a senior individual contributor and technical leader for cloud security. This is a step up from our Senior Cloud Security Engineer role. Where a Senior engineer executes and improves our cloud security controls, a Senior Cloud Security Engineer II sets the technical direction: you define the standards and reference patterns other engineers build on, lead cross-team security initiatives end to end, take on the ambiguous problems that don't yet have a playbook (and write the playbook), and raise the bar for the whole team through mentorship and review.

Responsibilities

• Set the technical direction (leadership & standards):
• Define the cloud security standards, guardrails, and reference architectures that Infrastructure, SRE, and Product Engineering build on , turning point-in-time fixes into durable, org-wide patterns
• Set your own objectives and roadmap for high-impact cloud security work, in partnership with Security Engineering leadership, and drive it to measurable outcomes
• Lead cross-functional security initiatives end to end , scope, timeline, stakeholders, and delivery , guiding technical debates to a decision and owning the result
• Mentor and uplevel other security and platform engineers through pairing, design review, and feedback; act as a force multiplier and the go-to technical resource for cloud security
• Represent cloud security in architecture and design forums, translating complex attack paths and risk into clear, actionable guidance engineers will actually adopt

• Secure architecture & threat modeling:
• Own threat modeling as a discipline for new cloud technologies, services, and patterns adopted across Engineering , making it a repeatable, scalable practice rather than a one-off exercise
• Partner with Infrastructure, SRE, and Product Engineering to design secure-by-default cloud architectures and build practical, scalable controls across AWS, GCP, and self-managed systems
• Drive control-plane and IAM security strategy across AWS and GCP, including relationships with external identity providers, RBAC models, and least privilege at scale
• Continually assess posture, surface systemic and emerging risk, and set the priorities that reduce it

• Detection engineering, incident response & automation:
• Advance our detection strategy: design high-signal detections and SIEM rules (with our SIEM Management function) and own detection coverage for cloud threats end to end
• Serve as a senior incident responder and cloud-forensics lead for cloud and run-time security investigations across AWS and GCP , and codify what you learn into standard IR playbooks and preventative controls
• Own and optimize security tooling such as CrowdStrike (EDR/CSPM/IR), Tenable, and native cloud security services, and lead our vulnerability management workflow , scanning, triage, prioritization, and remediation , for cloud assets

• Kubernetes & platform security:
• Own the security of our self-managed Kubernetes environments , control plane, nodes, workload isolation, admission control, run-time security, and the CI/CD supply chain feeding them
• Set the standards for Infrastructure-as-Code and pipeline security (Terraform preferred): design and harden IaC and CI/CD automation so security is built into how we ship
• Establish best practices for patch management, base-image hardening, and version management across containerized and VM-based environments
• Lead the security of large-scale, distributed systems and self-managed data stores (e.g., MongoDB), accounting for their real-world operational and security implications

Requirements

• Several years owning cloud security in production , on-call for it, not adjacent to it
• Hands-on, not theoretical: AWS as primary cloud, working GCP, self-managed Kubernetes
• You read and write code (Python, TF)

What We Offer

• Competitive compensation that may include equity
• Retirement and Employee Stock Purchase Plans
• Flexible paid time off
• Comprehensive benefit plans covering medical, dental, vision, life, and disability
• Family services that include fertility benefits and equal paid parental leave
• Professional development supported by formal career pathing, learning platforms, and a yearly learning stipend
• A curated in-office employee experience, designed to foster community, team connections, and innovation
• Opportunities to give back to your community, including an annual company-wide Volunteer Week and donation matching
• Employee Resource Groups that provide supportive communities within Braze
• Collaborative, transparent, and fun culture recognized as a Great Place to Work