Software Engineer - Staff Cloud Security Engineer

The role

You will design and build the controls that protect Arena's cloud infrastructure, including how workloads prove who they are, how machine credentials are stored and rotated, and what services can reach. You will do hands-on work with platform, infrastructure and product engineers, and share the security on-call rotation.

What you will do

• Design the cloud identity model for workloads, including least-privilege IAM, workload identity federation and short-lived credentials
• Own machine secrets and rotation end to end, with a central secret manager and a tested rotation path
• Set rules for what each environment and service may reach, including outbound limits and environment separation
• Build detections and alerts for high-risk changes to cloud infrastructure and build systems, with response steps
• Build cloud security checks into infrastructure code and build pipelines
• Secure machine credentials and permissions used by source control, build pipelines and cloud deployments
• Assess technical access requested by vendors and managed platforms before onboarding
• Lead technical response to cloud infrastructure security events through recovery
• Keep cloud security posture visible to engineering and leadership and improve it continuously
• Share the security on-call rotation

Required qualifications

• 6+ years in security or infrastructure engineering, with at least 3 focused on cloud security in production
• Deep, current hands-on experience securing AWS, GCP and Cloudflare
• Experience owning cloud security decisions for IAM and secrets
• Depth in workload identity: OIDC, workload identity federation, IAM design and secret managers
• Experience running credential rotation for production database or API credentials without an outage
• Detection and response experience in the cloud, including investigating events from cloud audit logs
• Comfort with Terraform or similar infrastructure-as-code, and at least one automation language such as Python, Go or TypeScript
• Experience securing build pipelines and CI/CD, such as GitHub Actions and deployment credentials
• Hands-on use of AI tooling in your own work
• Judgment about risk, distinguishing real exposures from theoretical ones
• Comfort improving existing systems and documentation while keeping work moving

Nice to have

• Securing serverless platforms such as Vercel
• Securing infrastructure for AI agent runtimes or sandboxed code execution
• Kubernetes security, Postgres access controls, or data platform security such as Databricks
• Leading incident response in a cloud environment
• Compliance evidence work for cloud controls: SOC 2 or ISO 27001
• Experience as an early security hire at a fast-growing startup
• Experience working with data protection requirements in logs and access controls

Benefits

• Competitive compensation aligned to the market where the team member is based
• Comprehensive health and wellness benefits
• Medical, dental and vision coverage
• Additional support programs
• Work on cutting-edge AI with a small, mission-driven team
• A culture that values transparency, trust and community impact

About the company

Arena is a platform for evaluating how AI models perform in real-world use, founded by researchers from UC Berkeley's SkyLab. The team includes people from UC Berkeley, Google, Stanford and DeepMind.