Cloud Security Engineer

Vitol is seeking a Cloud Security Engineer to join its Technology department. The role is
accountable for securing Vitol's AWS and Google Cloud (GCP) environments, and the workloads
that run on them, across our worldwide trading and physical operations.
The Cloud Security Engineer will build and run the controls that let engineering teams deliver in
the cloud quickly and safely, using platforms such as Wiz, CrowdStrike, Palo Alto Networks and
other CSPM. The role is the practical link between security requirements and the way cloud
services are built and operated.
The Cloud Security Engineer will work closely with the CISO organization, Developer Community
Enablement, product engineering and local infrastructure teams globally.
Key areas of responsibility for the Cloud Security Engineer include:
Cloud Security Controls: Design, deploy, and operate security controls across AWS and GCP, covering posture management (CSPM), workload protection (CWPP), identity and entitlements (CIEM), and network security.
Security Platform Engineering: Engineer and operate cloud security platforms such as Wiz, CrowdStrike Cloud Security, and Palo Alto Networks: onboard accounts and projects, tune policies, and route findings into existing workflows.
Baselines & Guardrails: Define and maintain secure baselines for AWS accounts and GCP projects, including organization policies, IAM, encryption, logging, and network segmentation.
Containers & Kubernetes: Secure container workloads on EKS and GKE, from image build through to runtime.
Data Protection: Protect sensitive data in the cloud and reduce the risk of data exfiltration.
Vulnerability Management & Incident Response: Prioritize cloud vulnerabilities and misconfigurations by risk, drive remediation with the owning teams, and support the Cyber Security & Assurance teams in the investigation of and response to cloud security incidents.
DevSecOps: Embed security checks in CI/CD pipelines (infrastructure-as-code scanning, SAST, secret detection, and image scanning), maintain policy as code, and review Terraform modules for security.
Automation: Automate remediation, evidence collection, and reporting through scripting and APIs.
Governance & Guidance: Build dashboards and KPIs on cloud security posture, present them in governance forums, and give engineering teams practical guidance on implementing controls.
Education: Undergraduate or postgraduate degree in a technical discipline (Computer Science, Engineering, Information Security, or a related field), or equivalent experience.
Cloud Security Experience: 5+ years of hands-on experience securing workloads in AWS and GCP, with depth in at least one and working knowledge of the other.
Security Platforms: Hands-on experience with at least one cloud-native application protection platform, such as Wiz, CrowdStrike Cloud Security, or Palo Alto Networks Prisma Cloud / Cortex Cloud.
Native Cloud Controls: Strong knowledge of AWS and GCP security controls, including IAM, key management, organization-level policies, logging, and network controls.
Infrastructure as Code & CI/CD: Experience with Terraform and with securing CI/CD pipelines.
Scripting & Automation: Proficiency in Python or a similar language.
Containers & Application Security: Understanding of container and Kubernetes security, and of application security fundamentals including the OWASP Top 10.
Data Protection: Experience protecting sensitive data and mitigating data exfiltration risk.
Certifications: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP or vendor certifications from Wiz, CrowdStrike, or Palo Alto Networks are an advantage.
Frameworks & Industry: Working knowledge of CIS Benchmarks, NIST, and ISO 27001, and familiarity with commodity trading or financial services environments, are an advantage.
Languages: Fluent English required and good knowledge of French an advantage

Skills
Python, AWS, GCP, Kubernetes, CI/CD, Terraform

Experience
5+ yrs

Employment type
Full-time

Work arrangement
No