ABOUT THE ROLE

We are looking for a staff-level cloud security engineer to build and improve the controls that protect Arena's cloud infrastructure. You will set how workloads prove who they are, where machine credentials live and how they rotate, what our services can reach, and how we know when something is wrong. Then you will build the controls that enforce it, in code.

This is a hands-on seat. You will do the work, not direct it from a distance.

Our engineers build on cloud and managed platforms for hosting, data, workflows, source control, and builds. You will set the security requirements for workload identity, machine credentials, and cloud access across them.

You'll work closely with platform, infrastructure, and product engineers to set cloud security requirements and build controls into the infrastructure they run.

This role is onsite in our San Francisco office and reports to the Head of Security.

YOU'LL

• Design the cloud identity model for workloads, not just administer it. Least-privilege IAM, workload identity federation, and short-lived credentials. You decide what a workload can do and how it proves who it is.

• Own machine secrets and rotation end to end. Every machine credential has an owner, a home in a central secret manager, and a rotation path that has been run, so rotating a key is routine and doesn't take the product down.

• Set the rules for what each environment and service may reach, including limits on outbound connections, separation between environments, and the boundaries around agent runtimes.

• Build security detections and alerts for high-risk changes to cloud infrastructure and build systems, and write response steps a colleague can follow without you.

• Build cloud security checks into infrastructure code and build pipelines, so the secure path is the easiest one.

• Secure the machine credentials and permissions used by source control, build pipelines, and cloud deployments.

• Assess the technical access requested by vendors and managed platforms before onboarding.

• Lead technical response to cloud infrastructure security events, working with the affected teams through recovery.

• Keep cloud security posture visible to engineering and leadership, and improve it continuously.

• Share the security on-call rotation.

YOU'LL HAVE

• 6+ years in security or infrastructure engineering, with at least 3 focused on cloud security in production.

• Deep, current, hands-on experience securing AWS, GCP, and Cloudflare. You can describe what you built or configured in the last three months at keyboard level.

• You have owned cloud security somewhere, not just worked a findings queue. You have made calls about how IAM and secrets should work, defended them, and lived with what they cost. You can name one you got wrong and changed.

• Real depth in workload identity. OIDC, workload identity federation, IAM design, and secret managers. You can explain how a workload proves who it is without a stored key.

• Rotation you have actually run. You can walk through rotating a production database or API credential without an outage, and what you would do differently next time.

• Detection and response in the cloud. You have written detections, been paged by them, and investigated a real event from cloud audit logs.

• Comfort in Terraform or a similar infrastructure-as-code tool, and in at least one language for automation such as Python, Go, or TypeScript.

• Experience securing build pipelines and CI/CD, such as GitHub Actions and deployment credentials.

• Hands-on with AI tooling in your own work. You use AI to build, script, and investigate, and you know where it belongs in a security workflow and where it doesn't.

• Judgment about risk. You can tell a real exposure from a theoretical one, and say plainly which is which.

• Comfort improving existing systems and documentation while keeping work moving.

BONUS POINTS

• Securing serverless platforms such as Vercel

• Securing infrastructure for AI agent runtimes or sandboxed code execution

• Kubernetes security, Postgres access controls, or data platform security such as Databricks

• Leading incident response in a cloud environment

• Compliance evidence work for cloud controls: SOC 2 or ISO 27001

• Experience as an early security hire at a fast-growing startup

• Experience working with data protection requirements in logs and access controls

What we offer

• We offer competitive compensation aligned to the markets where our team members are based. The compensation range for each role is listed on its posting and will depend on the candidate's experience and work location.