Staff Cloud Security Engineer

Xometry

. Design and build Xometry’s Isolated Recovery Environment using a hardened AWS account and immutable vaults .

Posted 9/17/2026full-timeDenver • Colorado • United StatesLead💰 $205,000 - $233,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in designing and implementing cloud-native recovery environments using AWS, Terraform, and automation tools. Proficient in scripting with Python or Go, and experienced in leading recovery efforts and high-availability architecture decisions.

Highest-signal resume keywords

AWS Cloud ExperienceTerraform ProficiencyPython or Go ScriptingCI/CD Tooling ExperienceInfrastructure as Code Leadership

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cloud Environment DesignBackup Configuration ValidationAutomated Workflow DevelopmentVersioned Recovery PlaybooksEnd-to-End Restoration AutomationAdvanced Shell ScriptingEKS/Kubernetes ExperienceChaos Engineering Tooling FamiliarityThreat ModelingHigh-Availability Architecture

Soft Skills

LeadershipCollaborationProblem-Solving

Tools & Technologies

TerraformAWSGCPAzureScalrGitHub Actions

Certifications & Qualifications

AWS Security Specialty Certification

Industry Keywords

NIST SP 800-34Immutable InfrastructureCloud-Native Attack PatternsRecovery DrillsCyber Attack Recovery

Tech Stack

Tools & technologies

AWSAzureBootstrapCloudGoogle Cloud PlatformKubernetesPythonShell ScriptingTerraformVaultGo

About the role

Key responsibilities & impact

Design and build Xometry’s Isolated Recovery Environment using a hardened AWS account and immutable vaults
Threat model cloud-native attack patterns including IAM privilege escalation, backup deletion, ransomware persistence, and lateral movement
Validate and improve backup configurations for recoverability
Lead the transition to 100% Infrastructure as Code using Terraform
Build automated workflows to tear down compromised environments and bootstrap fresh, hardened environments
Write and maintain executable, tested, versioned recovery playbooks
Develop Python or Go scripts to smoke test recovered data and validate integrity
Lead hands-on recovery drills and own after-action improvements
Shape high-availability architecture decisions and influence design reviews
Partner with Site Reliability Engineering on multi-region and high-availability design
Champion IaC and immutable infrastructure practices across engineering teams

Requirements

What you’ll need

8+ years of experience in complex cloud environments (AWS, GCP, or Azure), including at least 3 years in AWS
Strong Terraform skills and ability to modularize complex environments so they are environment-agnostic
Hands-on familiarity with the Secure Vault pattern in a separate, highly restricted AWS account
Advanced shell scripting
Proficiency in Python or Go
Experience with CI/CD tooling such as Scalr, GitHub Actions, or equivalent
Proven ability to engineer and automate end-to-end restoration workflows
EKS/Kubernetes experience is a strong plus
Preferred: hands-on experience leading technical recovery efforts from an actual cyber attack or destructive incident
Preferred: experience with chaos engineering tooling
Preferred: familiarity with NIST SP 800-34 or similar frameworks
Preferred: AWS Security Specialty certification or equivalent demonstrated expertise

Benefits

Comp & perks

Bonus
401(k) match
Medical insurance
Dental insurance
Vision insurance
Life insurance
Disability insurance
Generous paid time off, including vacation, sick leave, floating and fixed holidays
Maternity and bonding leave
Employee Assistance Program (EAP)
Wellbeing resources