​​Senior Cloud Security Engineering Lead​

ROLE RESPONSIBILITIES

The Senior Cloud Security Engineering Lead provides technical leadership and design expertise for the secure engineering of Pfizer's multi-cloud estate, and leads a small technical team of 3-5 cloud security engineers, providing guidance, mentorship and support in their professional development.

Security Engineering & Architecture

• Lead the design, implementation and management of multi-cloud security solutions focusing on preventative controls, scalability and automation.

• Own cloud security reference architectures, guardrails and landing zone controls across AWS, Azure and GCP.

• Design and architect standards for secure deployment and management of multi-cloud infrastructure, embedding security into platform patterns rather than bolting it on.

• Drive the adoption of policy-as-code and Infrastructure as Code security using Terraform, OpenTofu, Spacelift and Python.

Platform Automation & Detection Engineering

• Lead automation of security control deployment, posture remediation, and evidence collection across the cloud estate.

• Own detection engineering, logging pipelines and observability for cloud security telemetry at enterprise scale.

• Serve as escalation point for cloud security operational issues and lead root cause analysis for significant incidents.

Leadership & Collaboration

• Manage and mentor a team of 3-5 cloud security engineers, providing technical leadership, coaching and career development.

• Partner with Cyber Security, Risk, Compliance and Architecture teams to support audits, GxP and regulatory requirements, and governance initiatives.

• Collaborate with global cloud engineers, developers and product teams to build secure-by-default cloud-native capabilities.

• Ensure continuous improvement initiatives are identified, prioritized and addressed within the cloud security environment.

• Stay ahead of cloud security threats, technologies and engineering practices, and set the direction for their adoption.

Cyber Security Applications & Platforms in Scope

• The role engineers, secures and operates the cloud infrastructure underpinning Pfizer's core cyber security application estate, including:

• Ping - enterprise identity and access management / federation and single sign-on.

• SailPoint - identity governance and administration, access certification and lifecycle management.

• CyberArk (Palo Alto Idira) - privileged access management, secrets management and credential vaulting.

• CrowdStrike Amazon EKS - large-scale security log ingestion, retention and threat hunting.

Cutting-Edge & Agentic Cloud Security Capabilities

• This role sits at the front edge of AI-enabled security engineering. You will work with, evaluate, and operationalize emerging agentic capabilities that are reshaping how cloud security is delivered, including:

• Developer-embedded secret and credential protection - preventing credentials and secrets from ever reaching a repository, using GitHub Advanced Security (GHAS) push protection, secret scanning, code scanning and dependency review.

• Autonomous security agents for offensive testing - agent-driven penetration testing (black-box against external cloud estates and white-box against our own accounts) and continuous AI-assisted source code security review.

• AI red team and blue team agents within our cloud-native application protection tooling - using agentic red teaming to continuously probe cloud configurations and workloads, and blue team agents to accelerate detection, triage and response.

• AI-assisted vulnerability remediation - evaluating and adopting emerging code-repair models that generate and validate security fixes rather than only reporting findings.

• Hyperscaler-native security agents - early access and alpha programs from AWS, Microsoft and Google that bring agentic reasoning to cloud security posture, threat detection and automated remediation.

• Agentic security engineering at scale - building the guardrails, evaluation harnesses, and human-in-the-loop controls that let autonomous agents operate safely against a regulated, global pharmaceutical cloud estate.

BASIC QUALIFICATIONS

• Bachelor's Degree in Information Technology, Computer Science, Computer Engineering, or a similar discipline.

• 6+ years of experience in cloud engineering, cloud security or infrastructure roles.

• At least 2 years of experience in a technical leadership role, managing or leading engineering teams.

• Deep expertise in at least one major cloud platform (AWS, GCP, or Azure) with demonstrated familiarity across multiple cloud providers.

• Strong experience building and deploying cloud infrastructure using industry-standard IaC tools such as Terraform, OpenTofu, or Pulumi.

• Strong command of cloud security fundamentals: identity and access management, network security, encryption and key management, workload and container security, and logging/monitoring.

• Proficiency in at least one major programming language (Python strongly preferred) for security automation and tooling.

• Experience securing or operating enterprise security platforms such as IAM/SSO, identity governance, privileged access management, or SIEM/log analytics.

• Excellent communicator with the ability to influence horizontally and vertically across a large, complex, and matrixed organization.

• Strong technical leadership capabilities including the ability to coach, mentor, and develop other engineers.

• Customer-centric mentality with a bias towards delivering value at the speed demanded by the business.

• Demonstrated experience in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach.

PREFERRED QUALIFICATIONS

• Multi-cloud security experience across AWS, GCP, and Azure.

• Hands-on experience with Kubernetes / EKS security at scale.

• Experience with CNAPP / CSPM tooling and with GitHub Advanced Security or equivalent application security tooling.

• Experience applying AI or agentic tooling to security engineering problems.

• Experience qualifying cloud services capabilities for use within GxP or other highly regulated environments.

• Experience with Spacelift or similar IaC automation platforms.

• Relevant certifications (AWS/Azure/GCP Security Specialty, CISSP, CCSP, OSCP, or equivalent).

• Curious, self-driven and committed to continuous skill development, particularly around emerging AI security capabilities.

• Strong problem-solving and analytical mindset, especially for complex cloud systems.

• Comfortable operating with high ownership and autonomy.

• Customer-focused mindset with the ability to balance engineering excellence, security and business outcomes.

Please apply by sending your CV in English.

Work Location Assignment: Hybrid


Pfizer endeavors to make www.pfizer.com/careers accessible to all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process and/or interviewing, please email [email protected]. This is to be used solely for accommodation requests with respect to the accessibility of our website, online application process and/or interviewing. Requests for any other reason will not be returned.



To learn more about acceptable and prohibited uses of AI during the recruitment process, please review our candidate AI-use guidelines available on Pfizer Careers.


Information & Business Tech