Staff Cloud Security Engineer

About the Role

Xometry connects buyers with global manufacturing capacity through its digital marketplace. The Staff Cloud Security Engineer is a high-impact individual contributor responsible for cloud security posture, detection architecture, and runtime visibility across live cloud environments and containerized workloads.

You will own the CrowdStrike platform, partner with managed detection and response (MDR) providers on alert fidelity and escalation, and evaluate migration to a new SIEM. The role includes autonomy to remediate findings in a modern, cloud-native, SaaS-first environment.

Responsibilities

• Own CrowdStrike Falcon configuration, policy scoping, tuning, and actionable alert generation.
• Partner with MDR providers to define alert routing, triage thresholds, and escalation logic.
• Monitor primarily AWS environments for security posture drift, including misconfigured IAM roles, overly permissive security groups, exposed storage, and non-compliant resources.
• Secure Kubernetes clusters and containerized workloads through Network Policies, RBAC, Admission Controllers, and runtime detection.
• Develop and enforce AWS security policies and standards aligned with organizational risk posture.
• Evaluate and lead implementation of detection tooling, including cloud SIEM platforms, detection rules, and alerting pipelines.
• Enforce infrastructure-as-code security standards using Terraform or OpenTofu before deployment.
• Automate security posture checks and detection workflows using Python and shell scripting.
• Translate emerging cloud threats into detection coverage and posture improvements.

Minimum Qualifications

• At least 8 years of experience in cloud security, security engineering, or a related infrastructure security discipline.
• Hands-on experience with a CSPM platform such as CrowdStrike, Wiz, Prisma Cloud, Orca, or equivalent. Prior CrowdStrike experience is a plus, not a requirement.
• Deep familiarity with AWS security architecture, including IAM/SCP policy design, VPC networking, security groups, CloudTrail, and cloud-native security controls. GCP or Azure experience may substitute for AWS experience for strong candidates willing to expand into AWS.
• Proficiency with IaC tools such as Terraform, OpenTofu, or CloudFormation, including enforcement of security standards within IaC workflows.
• Strong Python and shell scripting skills for security automation, detection rule development, and tooling integration.
• US citizenship or legal permanent residency is mandatory because Xometry handles ITAR-controlled data.

Preferred Qualifications

• AWS GovCloud experience.
• Hands-on Kubernetes security experience managing production clusters, Network Policies, RBAC, and Admission Controllers.
• Experience with cloud-native SIEM solutions and writing detection rules in Python or SQL.
• Experience securing microservices architectures, including Istio or Linkerd service mesh security.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Compensation and Benefits

• Estimated annual base salary: $180,000–$200,000 plus bonus, depending on job-related skills, relevant experience, and location.
• 401(k) match; medical, dental, vision, life, and disability insurance.
• Generous paid time off, including vacation, sick leave, floating and fixed holidays, maternity and bonding leave.
• Employee assistance program and other wellbeing resources.

Location and Employment

• Full-time; Waltham, Massachusetts.
• Listed location type is remote; the posting also includes a hybrid tag.

Employment Verification

For US-based roles, Xometry participates in E-Verify. After an offer is accepted, Form I-9 information is provided to the federal government to confirm US work authorization.