Senior Security Engineer – Cloud Security & Security Operations

About the role

Our Information Security team is seeking a Senior Security Engineer (f/m/d) focused on Cloud Security and Security Operations. Your role will be instrumental in strengthening and scaling our cloud security architecture, detection capabilities, and incident response maturity across Moss' infrastructure and SaaS ecosystem. Reporting to the Director of Information Security, you will take ownership of how Moss detects, prioritises, and responds to security risks across GCP, SaaS systems, and internal services.

What you'll do

• Design and continuously improve Moss' security architecture in GCP, including IAM design, organisational policies, logging strategy, and network controls.
• Own and evolve our Cloud Security Posture Management setup in Wiz, prioritising and driving remediation of misconfigurations, identity risks, vulnerabilities, and runtime threats.
• Own and continuously improve our Datadog Cloud SIEM; develop, tune, and maintain detection rules across cloud logs, identity systems, SaaS integrations, and security-relevant application logs.
• Drive the integration of critical systems into the SIEM as part of vendor onboarding and annual control reviews; improve alert routing, triage workflows, and response coordination.
• Translate threat scenarios and real-world attack paths into effective detection coverage.
• Continuously improve log ingestion strategies across GCP, Google Workspace, Wiz, Atlassian, Jumpcloud and other critical systems.
• Investigate complex cloud and SaaS security events and incidents.
• Improve incident response playbooks, post-incident reviews, and learning loops; contribute to reducing MTTD and improving overall response effectiveness.

What you'll need

• Proven experience (5+ years) in security engineering with deep hands-on expertise in cloud security and security operations.
• Strong practical experience securing GCP environments, including IAM, Cloud Audit Logs, organisational policies, and network architecture.
• Strong experience securing Kubernetes environments (RBAC, service accounts, Workload Identity, network policies, container risks).
• Experience building and operating SIEM platforms (Datadog preferred; Splunk, Elastic or similar acceptable).
• Experience with Cloud Security Posture Management tools (Wiz preferred) and risk-based remediation workflows.
• Experience securing CI/CD pipelines (e.g. GitHub Actions), including identity federation and secret management.
• Strong understanding of cloud attack paths, identity risks, and modern infrastructure threats.
• Fluent English language skills, verbal and written.

What they offer

• Top-of-market compensation package, including equity.
• 20 days "work from abroad".
• 600 EUR/GBP Learning & Development Budget.
• Weekly breakfasts and Friday demos in vibrant offices.