# Lead Cloud Security Engineer at Vanguard

Vanguard is hiring a Lead Cloud Security Engineer. Level rates it Little AI ●○○○; you can [apply on Level](https://jobsbylevel.com/go/d1e8a838-d089-47ae-8961-d7e166070138?utm_medium=ai-agent).

AI Level 1, AI centrality 18 out of 100. Malvern, PA.

## Details

- Company: [Vanguard](https://jobsbylevel.com/companies/vanguard)
- AI level: AI Level 1 (score 18 out of 100)
- Location: Malvern, PA
- Posted: October 16, 2026
- Apply: https://jobsbylevel.com/go/d1e8a838-d089-47ae-8961-d7e166070138?utm_medium=ai-agent

## Description

The stack you'll work with: Core — Hands-on day one AWS IAM — roles, policies, trust and resource-policy patterns, permission boundaries, SCPs. CloudFormation (JSON/YAML) — heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits). Python for production-grade tooling , policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3). CI/CD pipelines (GitHub Actions, Bamboo, or similar) for building, testing, and shipping controls. Core AWS at org scale — Organizations, IAM Identity Center, and services such as Lambda, EventBridge, Step Functions, S3, API Gateway, and CloudWatch. Nice to have — or you'll pick up fast Security-native AWS — Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS. CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana). Data skills (SQL and JSON, ETL, Tableau/Power BI). Multi-cloud exposure (GCP, Azure, OCI). PowerShell, PySpark, and AI-assisted tooling. Core Responsibilities: Technical Leadership Lead technical design reviews and own the standards for how controls are built, tested, and shipped — raising the bar on code quality, systems thinking, and operational readiness. Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff. Influence engineering patterns and best practices across teams — driving technical direction beyond your immediate team, without direct authority. Solution Design & Delivery Design enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on — designing for auditability, fault tolerance, and graceful degradation when upstream systems change. Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts — owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM). Move fluidly between design and hands-on build; stay close to the code. Automation & Infrastructure as Code Build preventive and detective controls as code — author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (CloudFormation and/or Terraform) and policy-as-code (Rego/OPA). Embed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control. Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate). Security Engineering & Strategy Engineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale. Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls. Translate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness. Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed. Qualifications: Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred. Strong hands-on engineering — writes and ships production-grade code (Python or equivalent — production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with CloudFormation day to day (Terraform a plus). Deep cloud expertise — hands-on experience across at least one of AWS, GCP, or Azure (AWS strongly preferred), at the level of org-wide account structures, landing zones, and cross-account security patterns at scale. Technical leadership & influence — a track record of leading

The description is cut here. Read the full offer: https://jobsbylevel.com/jobs/lead-cloud-security-engineer-at-vanguard-97985a

Source: https://jobsbylevel.com/jobs/lead-cloud-security-engineer-at-vanguard-97985a

## Cite this page

Level. https://jobsbylevel.com/jobs/lead-cloud-security-engineer-at-vanguard-97985a.

Get job alerts: https://jobsbylevel.com/newsletter