Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 4 days ago

Senior Cloud Security Engineer

Tessera Labs26 open roles

Pay
$200,000 – $250,000 a year
Where
Remote in the U.S.
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Cloud Security EngineerTessera Labs · Remote in the U.S.

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Tessera Labs's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.1% of postings close within 7 days. Measured by our own scanner across the market. Tessera Labs postings stay open a median of 27 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.1%7 days
  4. 19.1%14 days
  5. 35.6%30 days
  6. 52.7%60 days
This job: posted 4 days ago

Tessera Labs median: 27 days open

The posting

SENIOR CLOUD SECURITY ENGINEER

THE ROLE

We're hiring a Senior Cloud Security Engineer to make our cloud environments secure by default. You'll design and build the guardrails, automation, and detection that keep our infrastructure defensible across multiple cloud providers.

You'll do it with a DevOps mindset: writing code, shipping changes through the same pipelines our engineers use, and building paved roads teams want to adopt, rather than handing down policy from the outside.

This role partners closely with platform and infrastructure engineering, customer support, and delivery teams, as well as IT and compliance.

WHAT YOU'LL DO

- Own the security posture of our cloud environments across Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, applying consistent controls across providers.

- Design secure reference architectures and reusable patterns — account and project structure, network segmentation, encryption and key management, secrets management — that teams can adopt instead of reinventing.

- Build security into Infrastructure as Code (IaC) through hardened modules, policy as code, and pre-deploy checks, so misconfigurations are caught before they reach production.

- Secure Continuous Integration / Continuous Delivery (CI/CD) pipelines and the software supply chain: pipeline permissions, secrets handling, artifact integrity, and short-lived workload identity in place of long-lived keys.

- Design and enforce least-privilege Identity and Access Management (IAM) across clouds, including role design, federation with our identity provider, and periodic access reviews.

- Write code and scripts to automate security controls, remediation, and evidence collection — if you do something twice, you automate it the third time.

- Operate and tune Cloud Security Posture Management (CSPM) and cloud-native security services, and drive findings through to remediation with owning teams.

- Build logging and detection for cloud control-plane and workload activity, and lead the cloud side of incident response.

- Contribute security controls and evidence to our compliance posture (System and Organization Controls 2, or SOC 2, ISO 27001, etc.).

WHAT YOU'LL NEED (REQUIRED)

- A DevOps foundation — you've worked in a DevOps, Site Reliability Engineering (SRE), or platform engineering role, and you've built and operated production infrastructure and CI/CD pipelines yourself, not just reviewed them.

- Hands-on production experience securing at least two major cloud providers (AWS, GCP, or Azure), and a clear understanding of how their identity, networking, and logging models differ.

- Deep knowledge of cloud security best practices — for example, the Center for Internet Security (CIS) Benchmarks and each provider's security foundations guidance — and the judgment to apply them pragmatically rather than as a checklist.

- Fluency in proven cloud security patterns: least-privilege IAM and workload identity, network segmentation and private connectivity, encryption and key management, secrets management, centralized logging, and preventive guardrails (for example, AWS Service Control Policies or GCP Organization Policies).

- Strong coding and scripting skills in at least one general-purpose language (for example, Python or Go) plus shell scripting; you write automation other engineers can read and maintain.

- Hands-on experience with IaC (for example, Terraform or OpenTofu) and with embedding security checks into it.

- Strong communication skills — you work directly with engineers and can explain risk in terms they'll act on.

NICE TO HAVE

- Familiarity with open-source cloud security tooling (for example, Prowler for posture assessment, Checkov or Trivy for IaC and container scanning, Open Policy Agent (OPA) for policy as code, Falco for runtime detection).

- Container and Kubernetes security experience (Amazon EKS, Google Kubernetes Engine, or Azure Kubernetes Service), including admission control and runtime policy.

- A relevant cloud security certification (for example, AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, Microsoft Azure Security Engineer Associate, or Certified Cloud Security Professional, CCSP).

- Experience securing SaaS and developer platforms, such as identity providers and GitHub organizations.

- Experience supporting a SOC 2, ISO 27001, or similar program, including compliance automation platforms.

- Hands-on cloud incident response or forensics experience.

WHAT SUCCESS LOOKS LIKE (FIRST 90 DAYS)

- You've mapped our cloud footprint across providers — accounts and projects, identities, internet exposure, and sensitive data stores — and identified the highest-priority risks with a remediation plan.

- Baseline guardrails, centralized logging, and posture monitoring cover every cloud account and project, with findings routed to the teams that own them.

- Security checks run automatically on infrastructure changes in CI/CD, and engineers know how to engage you early on new infrastructure work.

LOCATION AND WORK MODEL

Remote in North America

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Tessera Labs's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Tessera Labs's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Tessera Labs's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.