Arena Staff Cloud Security Engineer at Arena responsible for designing and building cloud security controls and identity models. Hands-on role managing machine credentials, workload identity, and security detections.
Responsibilities
We are looking for a staff-level cloud security engineer to build and improve the controls that protect Arena's cloud infrastructure. You will set how workloads prove who they are, where machine credentials live and how they rotate, what our services can reach, and how we know when something is wrong. Then you will build the controls that enforce it, in code.
This is a hands-on seat. You will do the work, not direct it from a distance.
Our engineers build on cloud and managed platforms for hosting, data, workflows, source control, and builds. You will set the security requirements for workload identity, machine credentials, and cloud access across them.
You'll work closely with platform, infrastructure, and product engineers to set cloud security requirements and build controls into the infrastructure they run.
This role is onsite in our San Francisco office and reports to the Head of Security.
Design the cloud identity model for workloads, not just administer it. Least-privilege IAM, workload identity federation, and short-lived credentials. You decide what a workload can do and how it proves who it is.
Own machine secrets and rotation end to end. Every machine credential has an owner, a home in a central secret manager, and a rotation path that has been run, so rotating a key is routine and doesn't take the product down.
Set the rules for what each environment and service may reach, including limits on outbound connections, separation between environments, and the boundaries around agent runtimes.
Build security detections and alerts for high-risk changes to cloud infrastructure and build systems, and write response steps a colleague can follow without you.
Build cloud security checks into infrastructure code and build pipelines, so the secure path is the easiest one.
Secure the machine credentials and permissions used by source control, build pipelines, and cloud deployments.
Assess the technical access requested by vendors and managed platforms before onboarding.
Qualification
Real depth in workload identityRotation you have actually runDetection and response in the cloudJudgment about riskKubernetes security
Required
Real depth in workload identity. OIDC, workload identity federation, IAM design, and secret managers. You can explain how a workload proves who it is without a stored key.
Rotation you have actually run. You can walk through rotating a production database or API credential without an outage, and what you would do differently next time.
Detection and response in the cloud. You have written detections, been paged by them, and investigated a real event from cloud audit logs.
Comfort in Terraform or a similar infrastructure-as-code tool, and in at least one language for automation such as Python, Go, or TypeScript.
Experience securing build pipelines and CI/CD, such as GitHub Actions and deployment credentials.
Hands-on with AI tooling in your own work. You use AI to build, script, and investigate, and you know where it belongs in a security workflow and where it doesn't.
Judgment about risk. You can tell a real exposure from a theoretical one, and say plainly which is which.
Comfort improving existing systems and documentation while keeping work moving.
Preferred
Securing serverless platforms such as Vercel
Securing infrastructure for AI agent runtimes or sandboxed code execution
Kubernetes security, Postgres access controls, or data platform security such as Databricks
Leading incident response in a cloud environment
Compliance evidence work for cloud controls: SOC 2 or ISO 27001
Experience as an early security hire at a fast-growing startup
Experience working with data protection requirements in logs and access controls
