Senior Cloud Security Engineer

About the role

Checkout.com is scaling a multi‑cloud environment rapidly, with security architecture at its core. As a Senior Cloud Security Engineer you will work closely with Engineering, GRC, Technology Risk, and Security Operations to embed security into every design decision and maintain visibility across the estate.

Key responsibilities

• Develop and enforce reference security architectures, patterns, and blueprints for secure cloud adoption across AWS, Azure, and GCP.
• Conduct security assessments for new cloud services, defining preventative and detective controls via security guardrails to maintain posture and detect drift.
• Partner with Engineering teams to embed security guardrails early in design, ensuring compliance and resilience without adding friction.
• Evaluate engineering and platform architecture proposals, identify security gaps and drive remediation to completion.
• Document and uphold secure‑by‑design principles and architecture governance, enforcing policy‑as‑code frameworks aligned with NIST, CIS, and PCI DSS.
• Set monitoring scope and priorities for CNAPP/CSPM tooling (e.g., Wiz), defining critical misconfigurations and vulnerabilities against benchmarks and holding teams accountable.
• Work with Security Operations to shape cloud logging and detection requirements, ensuring SIEM visibility across the estate.
• Collaborate with senior stakeholders to articulate security risks and mitigations in business‑focused terms.

Required profile

• Strong technical expertise with 6+ years of hands‑on cloud security experience and deep knowledge of at least one platform (AWS, Azure, or GCP).
• Experience with Kubernetes (EKS/AKS/GKE), API security, and Infrastructure‑as‑Code security (Terraform, CloudFormation, ARM templates).
• Proven ability to make risk‑based decisions and adhere to regulatory standards such as PCI DSS, NIST, SOC 2, ISO 27001, and CIS.
• Excellent communication, senior‑stakeholder engagement, and mentoring skills.

Required skills

• AWS, Azure, GCP
• Kubernetes (EKS, AKS, GKE)
• Terraform, CloudFormation, ARM templates
• Policy‑as‑code, CNAPP/CSPM tools (e.g., Wiz)
• SIEM integration and cloud logging
• Security frameworks: NIST, CIS, PCI DSS

What we offer

• Hybrid working model with three days per week in the office.
• Opportunity to work on high‑impact security challenges in a fast‑moving fintech environment.