Cloud Security Engineer

Company Background

Our client is a travel technology company developing cloud-native, AI-powered software for airlines and hospitality brands. Its products help customers improve commercial performance, reduce costs, and evolve their digital commerce capabilities. The company’s technology is designed to work alongside existing airline systems, allowing customers to introduce new capabilities without replacing their current technology landscape.

Project Description

You will contribute to a large-scale greenfield travel-technology initiative supporting the launch of a new airline operation. The project uses a modern commercial platform to enable flexible retailing, pricing, and digital shopping experiences across travel products and ancillary services.

Technologies

• GCP, AWS
• Wiz
• Cloudflare WAF, Bot Management, DNS, TLS, DDoS Protection and Rate Limiting
• Terraform
• SonarCloud and Dependabot
• Jira, PagerDuty and Slack
• Python and Bash

What You'll Do

• Own and continuously improve cloud security posture across GCP organizations and AWS accounts, including connector coverage, runtime sensor deployment on production clusters, custom policy development, finding-triage baselines, and integrations with Jira, PagerDuty, and Slack;
• Operate and evolve the edge security layer, centralizing internet-facing protection through Cloudflare WAF, bot management, rate limiting, DNS/TLS, and origin routing for customer-facing production zones;
• Tune security rules using real production traffic, manage allow-list requests, and enable other teams to use edge-security tooling effectively;
• Support and automate vulnerability management and secure configuration, maintaining the intake of Wiz, SAST, penetration-test, and customer-reported findings, defining remediation baselines, and driving owners to closure;
• Participate in security incident response for cloud events, including DDoS and bot attacks, supply-chain alerts, credential exposure, and data-handling incidents, while creating and maintaining detection, triage, and mitigation runbooks;
• Help secure the software supply chain by owning SAST reporting in SonarCloud, dependency scanning with Dependabot, container base-image hardening, and the selection of SBOM and SCA tooling, and publish release-level security reports for engineering teams;
• Produce technical evidence for SOC 2, PCI DSS, ISO 27001, and NIS2, including evidence of log-sink configuration and retention, access reviews, authenticated scanning, and IAM remediation, and map Wiz controls to relevant frameworks to make evidence collection repeatable;