Security Engineer

Summary

Cloudbeds is a hospitality technology company providing a unified platform for hotel operations and commercial strategy. The Security Engineer will protect Cloudbeds’ customers and business by remediating vulnerabilities, engineering SIEM detections, responding to incidents, hardening AWS infrastructure, securing delivery pipelines, and supporting compliance obligations.

Responsibilities

• Find and fix vulnerabilities across our stack. Work directly in the application repositories and in Terraform, open the pull requests, and drive them to merge with the owning squads
• Build and tune detections in Datadog Cloud SIEM. Own detection coverage, write the rules, cut the false positives, and map what we can and cannot see against MITRE ATT&CK
• Respond to security incidents. Investigate, contain, and write the RCA, then track the remediation actions until they are genuinely closed
• Harden our AWS estate. GuardDuty, Security Hub, Config, CloudTrail, KMS, Secrets Manager, IAM least privilege, and full log coverage across every account
• Secure the delivery pipeline. GitHub Advanced Security, code scanning, Dependabot, secret scanning and push protection, Crowdstrike container and image scanning, and Kubernetes admission policy
• Automate the repetitive work. Build workflows and scripts that triage, enrich, and remediate without a human in the loop
• Write the runbooks, standards, and detection documentation engineers will actually use, and produce the technical evidence behind our PCI DSS Level 1, GDPR, and SOC 2 obligations

Skills

• A Bachelor's degree in a relevant field and 4 years of experience, or a minimum of 6 years of practical experience in security engineering, detection engineering, or incident response
• You write code
• You can read an unfamiliar application repository, reason about the vulnerability, and ship the fix as a pull request rather than a ticket
• Deep AWS security experience
• IAM and least-privilege design, GuardDuty, CloudTrail, KMS, VPC controls, and securing container and serverless workloads
• Hands-on detection engineering in a SIEM
• You have written rules, tuned them against real noise, and can explain what you deliberately chose not to alert on
• Real incident response experience in cloud environments, covering investigation, containment, evidence handling, and the write-up afterward
• Application security fundamentals: OWASP Top 10, dependency and secrets risk, and practical CI/CD security integration (SAST, DAST, SCA, IaC scanning)
• Strong written communication and diplomacy
• Our teams communicate in English
• You will need to win arguments with evidence rather than authority
• Applicants must be currently authorized to work in the location where the position is located without requiring visa sponsorship
• At this time, Cloudbeds is unable to provide sponsorship for work visas
• Production experience with Datadog Cloud SIEM, CrowdStrike, Okta, or GitHub Advanced Security
• PCI DSS Level 1 or SOC 2 experience as the engineer supporting the audit, not just as the person answering questionnaires
• Kubernetes and ArgoCD security, or automation and policy-as-code with Python and Terraform

Qualifications

Must Haves

• A Bachelor's degree in a relevant field and 4 years of experience, or a minimum of 6 years of practical experience in security engineering, detection engineering, or incident response
• You write code
• You can read an unfamiliar application repository, reason about the vulnerability, and ship the fix as a pull request rather than a ticket
• Deep AWS security experience
• IAM and least-privilege design, GuardDuty, CloudTrail, KMS, VPC controls, and securing container and serverless workloads
• Hands-on detection engineering in a SIEM
• You have written rules, tuned them against real noise, and can explain what you deliberately chose not to alert on
• Real incident response experience in cloud environments, covering investigation, containment, evidence handling, and the write-up afterward
• Application security fundamentals: OWASP Top 10, dependency and secrets risk, and practical CI/CD security integration (SAST, DAST, SCA, IaC scanning)
• Strong written communication and diplomacy
• Our teams communicate in English
• You will need to win arguments with evidence rather than authority
• applicants must be currently authorized to work in the location where the position is located without requiring visa sponsorship
• At this time, Cloudbeds is unable to provide sponsorship for work visas

Nice to Haves

• Production experience with Datadog Cloud SIEM, CrowdStrike, Okta, or GitHub Advanced Security
• PCI DSS Level 1 or SOC 2 experience as the engineer supporting the audit, not just as the person answering questionnaires
• Kubernetes and ArgoCD security, or automation and policy-as-code with Python and Terraform

Benefits

• Remote First, Remote Always
• PTO in accordance with local labor requirements
• Fully Paid Parental Leave
• Home office stipend based on country of residency
• Professional development courses in Cloudbeds University
• Access to professional development, including manager training, upskilling, and knowledge transfer