SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Demandbase is a pipeline AI platform for B2B go-to-market teams, trusted by thousands of enterprises to automate growth, align account-based strategies, and consolidate data and tech stacks. The company has offices in San Francisco, New York, Austin, Seattle, India, and the United Kingdom.
You will join the Product Security team as a hands-on Senior Security Engineer, owning cloud security posture and risk reduction across AWS, GCP, Kubernetes, containers, virtual machines, and infrastructure-as-code environments. This is an ownership-oriented role for an engineer who can independently investigate complex cloud-security problems, prioritize risk based on exploitability and business impact, drive remediation to closure, and communicate clearly with both engineers and leaders.
Key responsibilities include:
**Cloud Security Ownership:** Own cloud-security posture across multi-cloud environments. Independently investigate complex misconfigurations and attack paths, determine actual exposure, and drive issues from discovery through verified closure. Partner with engineering teams to design secure, scalable solutions.
**Architecture and Infrastructure-as-Code:** Perform security reviews for new cloud services, infrastructure designs, network patterns, and high-risk architectural changes. Review Terraform and CI/CD workflows, and develop preventive controls that identify or block insecure infrastructure before deployment. Strengthen secure-by-default patterns for cloud accounts, projects, workloads, networking, storage, secrets, encryption, logging, and service-to-service access.
**Identity and Access Management:** Evaluate AWS IAM, GCP service accounts, workload identity, federation, trust relationships, and privileged access against least-privilege principles. Reduce excessive permissions, long-lived credentials, dormant identities, insecure keys, and privilege-escalation paths.
**Kubernetes, Containers, and Compute Security:** Assess Kubernetes RBAC, workload identity, admission controls, network policies, secrets handling, and cluster isolation. Drive adoption of golden images, secure base images, automated upgrades, and timely remediation of critical vulnerabilities. Improve the health of active container images and virtual machines.
**Risk Triage, Automation, and Metrics:** Lead risk-based triage of cloud-security findings using tools like Wiz. Build scripts, integrations, guardrails, dashboards, and automated remediation workflows. Define and report outcome-oriented metrics for external exposure, IAM risks, Kubernetes issues, and remediation aging.
**Incident Support and Technical Leadership:** Support cloud incident investigations with attack-path analysis, evidence collection, and blast-radius assessment. Represent Product Security in technical discussions and risk escalations. Mentor security and engineering team members and help develop reliable secondary owners for cloud-security domains.
You will partner closely with Cloud Engineering, SRE, Platform, Infrastructure, Product Engineering, and Security Incident Response teams. This role offers an opportunity to shape cloud-security engineering at scale, reduce systemic risk across a modern multi-cloud environment, mentor developing security engineers, and grow toward broader technical leadership.
**Requirements:**
- 5+ years of experience in security, infrastructure, platform engineering, or a related technical field, including 4+ years of hands-on cloud-security experience
- Deep practical knowledge of AWS/GCP in production environments
- Strong knowledge of Kubernetes, containers, Linux, virtual machines, cloud networking, storage, secrets management, encryption, and logging
- Hands-on expertise in cloud IAM, including AWS IAM, GCP service accounts, workload identity, federation, policy evaluation, and least-privilege design
- Experience reviewing or developing Terraform and integrating security controls into CI/CD workflows
- Experience using a CSPM platform such as Wiz to investigate and prioritize risk; ability to go beyond tool output and validate technical impact
- Ability to automate security workflows using Python, Go, APIs, or similar technologies
- Strong understanding of cloud attack techniques, privilege escalation, lateral movement, internet exposure, data exfiltration, and workload isolation
- Demonstrated ability to own ambiguous problems, work independently, and drive cross-functional remediation to measurable completion
- Excellent written and verbal English communication skills, including the ability to explain technical risk and remediation to engineers and leaders
- Experience mentoring engineers or leading technical initiatives across multiple teams is strongly preferred
- Relevant certifications such as AWS Certified Security - Specialty, Google Professional Cloud Security Engineer, CKS, CISSP, or equivalent practical experience are desirable
