Staff Cloud Security Engineer

About Xometry

Xometry operates a digital marketplace connecting buyers with manufacturers and global manufacturing capacity.

Role

As a Staff Cyber Resilience Engineer, lead defenses against ransomware, destructive wipes, and data loss at scale. This hands-on technical leadership role owns the Isolated Recovery Environment, sets Infrastructure as Code standards, and ensures operations can be restored quickly and reliably if the AWS environment is compromised.

The posting lists Denver, CO and Remote as the location type, but also includes a #LI-Hybrid tag.

Responsibilities

Recovery Architecture

• Design and build a hardened, isolated AWS recovery account with immutable vaults.
• Threat model cloud-native attacks, including IAM privilege escalation, backup deletion, ransomware persistence, and cross-account lateral movement.
• Validate and improve backup configurations for recoverability.

Infrastructure Standardization and Automation

• Lead the transition to 100% Infrastructure as Code, defining VPCs, IAM roles, security groups, and other assets in Terraform.
• Enable automated redeployment of the entire stack into a clean account.
• Build workflows to tear down compromised environments and bootstrap hardened replacements from verified code and clean data.
• Maintain tested, versioned, executable recovery playbooks containing the API calls and CLI commands needed to restore applications.

Recovery Validation and Exercises

• Develop Python or Go scripts to smoke test recovered data and validate post-restoration integrity.
• Lead hands-on drills simulating total loss of critical environments and recovery into secondary clean accounts.
• Own after-action reviews and drive improvements.

Engineering Standards

• Shape high-availability architecture decisions and influence design reviews as the organization's resilience authority.
• Partner with Site Reliability Engineering on multi-region deployments and high-availability design.
• Champion Infrastructure as Code and immutable infrastructure across teams.

Qualifications

• At least 8 years of experience in complex cloud environments using AWS, GCP, or Azure, including at least 3 years in AWS.
• Strong Terraform skills, including modularizing complex environments to be environment-agnostic.
• Hands-on familiarity with the Secure Vault pattern: protecting data in a separate, highly restricted AWS account with tight network controls.
• Advanced shell scripting and proficiency in either Python or Go.
• Experience with CI/CD tooling such as Scalr, GitHub Actions, or equivalent.
• Proven ability to engineer and automate end-to-end restoration workflows.

Preferred Qualifications

• EKS/Kubernetes experience.
• Experience leading technical recovery from an actual cyberattack or destructive incident.
• Experience with chaos engineering tooling.
• Familiarity with NIST SP 800-34 or similar contingency-planning frameworks.
• AWS Security Specialty certification or equivalent demonstrated expertise.

Compensation and Benefits

• Estimated annual base salary: $205,000–$233,000, plus bonus, depending on job-related skills, relevant experience, and location.
• Benefits include 401(k) match; medical, dental, vision, life, and disability insurance; vacation, sick leave, floating and fixed holidays; maternity and bonding leave; EAP and other wellbeing resources.

Employment Verification

For US-based roles, Xometry participates in E-Verify. After an offer is accepted, Form I-9 information is provided to the federal government to confirm authorization to work in the United States.