Head of Security Engineering, Keyrock

• Deep knowledge of AWS and AWS Key Management Service (KMS)—including key policies, grants, cross-account patterns, and rotation—is essential
• 8+ years in security engineering (cloud, platform, and/or product security), with 3+ years leading teams or leading org-wide technical programs
• Expert AWS security experience in production environments (multi-account, high availability)
• Deep AWS KMS expertise: key policies, grants, rotation, and cross-account usage patterns
• Strong working knowledge of IAM, identity design, and least-privilege access controls in cloud environments
• Proven ability to build security automation (infrastructure-as-code, CI/CD integration, policy enforcement, developer enablement)
• Clear communication skills: can write standards/runbooks and influence senior engineers and executives

Desirable

• As Leader of Security Engineering, you will set the technical direction and execution for Keyrock’s security engineering program—building secure-by-design cloud foundations, developer "paved roads," and cryptographic/key-management controls appropriate for a high-availability trading environment
• This is a hands-on leadership role
• You'll lead and grow a high-performing security engineering team (cloud, platform, application security), setting roadmap, standards, and measurable outcomes
• Establish engineering patterns that balance speed and control (secure defaults, automation-first, self-service guardrails)
• Own cloud security architecture for AWS: landing zone patterns, multi-account strategy, network segmentation, identity and access design, logging/telemetry baselines, and infrastructure hardening
• Build preventative controls using infrastructure-as-code and policy-as-code; drive adoption across engineering teams
• Own the enterprise encryption program in AWS, including KMS key policy design and governance (least privilege, separation of duties, break-glass, auditable admin/use roles)
• Define safe grant usage patterns and operational best practices for AWS services and applications
• Own key lifecycle management: rotation strategy, aliasing/migration patterns, and recovery considerations
• Design cross-account and multi-account access patterns and controls aligned to Keyrock’s cloud operating model
• Embed security into the SDLC: threat modeling, secure coding guidance, code scanning, dependency controls, build-time checks, and release gates
• Partner with Platform Engineering to harden runtime environments (containers, Linux, CI/CD runners, secrets management, service-to-service authentication)
• Partner with Security Operations to ensure engineering-driven outcomes: high-signal detections, incident response tooling readiness, forensic logging, and secure configurations that reduce blast radius