Cloud Security Engineer

• Operate and improve CSPM, CNAPP and DSPM tooling across R2’s AWS footprint
• Identify, prioritize, triage and track remediation of cloud security findings end-to-end
• Ensure zero open high-severity findings older than 30 days
• Implement and harden IAM controls, encryption, secrets management and data protection across AWS accounts
• Own secrets rotation and access review processes for production systems
• Integrate security controls into CI/CD pipelines, including SAST/SCA/IaC scanning with blocking criteria for high-severity findings
• Automate security processes via Python, Bash, Go, APIs and Terraform/IaC
• Manage and harden WAF rule sets, security groups, NACLs and network segmentation across VPCs
• Tune and maintain AWS WAF rate-limiting thresholds and manage rule groups against scanning and malicious traffic
• Enforce least-privilege network access across accounts and environments
• Contribute to securing GenAI applications, RAG architectures, agents, APIs, connectors and MCP servers
• Design and build internal AI/LLM-based security agents for threat detection, finding triage and incident response
• Define controls against data leakage, improper access, prompt injection and unsafe tool use by autonomous agents
• Collaborate with the SOC on alert integration and SIEM use-case development
• Build and maintain security documentation, runbooks and standards
• Support incident response, root cause analysis and remediation across production environments
• Report to the Director of Infrastructure and work closely with Security, Infrastructure and Platform Engineering teams

• 3–5 years of experience in cloud security, DevSecOps or a similar role
• Hands-on experience with CSPM/CNAPP/DSPM platforms (Wiz, Prisma Cloud, Orca or equivalent)
• Strong AWS security knowledge (IAM, KMS, Secrets Manager, Security Hub, GuardDuty, Inspector)
• Experience embedding security into CI/CD pipelines and Infrastructure as Code (Terraform)
• Scripting ability (Python, Bash; Go a plus) for security automation via APIs
• Familiarity with Kubernetes/EKS and container security
• Experience hardening network security controls (WAF, security groups, NACLs, VPC segmentation)
• Understanding of GenAI/LLM security risks (prompt injection, agentic tool misuse, data leakage)
• English proficiency — written and spoken (required)
• AWS Certified Security – Specialty (nice to have)
• Experience with SIEM/SOAR platforms (nice to have)
• Familiarity with ISO 27001, SOC 2, or similar compliance frameworks (nice to have)
• Fintech or regulated-industry experience (nice to have)

• Eligible team members have the opportunity to participate in R2’s Phantom Share Program, a performance-based incentive
• The chance to join a high-impact, mission-driven fintech
• Ownership and impact in a fast-paced, growth-oriented startup
• Cross-functional collaboration with exceptional teams
• Exposure to complex regulatory challenges and innovation in embedded finance