<p><span style="font-size: 10pt;">Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.</span></p> <p><span style="font-size: 10pt;">The Product & Platform Security team at Toast protects the cloud infrastructure and services that restaurants depend on every day. We are looking for a Staff Engineer, Cloud Security to expand the scope and coverage of our cloud security capabilities. You will join an existing cloud security team and take a role in setting direction for how Toast secures its cloud environments. This is a hands-on role with technical leadership responsibilities: you will build and operate security tooling and controls yourself, while also shaping strategy, mentoring teammates, and influencing the roadmaps of engineering teams across R&D.</span></p> <p><span style="font-size: 10pt;">Our footprint is primarily AWS. You will work closely with Platform and Infrastructure teams in R&D, and with Defense & Response and other Security Engineering teams within Trust & Security.</span></p> <p><span style="font-size: 10pt;"><strong>A day in the life (Responsibilities)</strong></span></p> <ul> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Own and operate our Cloud-Native Application Protection Platform (CNAPP), including tuning, coverage, integrations, and turning findings into prioritized, actionable work for engineering teams.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Lead cloud security posture management (CSPM) across our AWS organization and accounts, defining standards and measuring adherence over time.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Drive identity and access management improvements, including least privilege, role and permission design, and reducing standing access.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Secure our container environments, from image and workload security to cluster configuration and runtime protection.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Build guardrails and secure defaults into infrastructure as code and deployment pipelines, so that teams get secure configurations by default rather than through review.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Perform secure architecture reviews and threat modeling for new and existing cloud services and platform capabilities.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Partner with our SOC on cloud detection coverage, logging, and investigation readiness.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Run and improve cloud vulnerability and misconfiguration remediation programs, working with engineering owners to drive risk down.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Participate in security incident response, including on-call coverage, and lead the cloud side of investigations and follow-up work.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Set the multi-year direction for cloud security at Toast, and mentor and uplevel other engineers on the team.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Build trusted relationships with Platform, Infrastructure, and product engineering leaders, and influence their priorities through data and clear risk communication.</span></li> </ul> <p><span style="font-size: 10pt;"><strong>What you'll need to thrive (Requirements)</strong></span></p> <ul> <li style="font-size: 10pt;"><span style="font-size: 10pt;">8+ years of experience in security engineering, infrastructure, or software engineering, with significant time focused on cloud security.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Deep, hands-on experience securing AWS environments at scale, including IAM, Organizations, networking, logging, and core security services.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Experience deploying and operating cloud security tooling, such as CNAPP or CSPM platforms (for example Orca, Wiz, or Upwind).</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Experience with container and Kubernetes security (for example EKS).</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Experience performing threat modeling and security architecture reviews for cloud services and platform capabilities.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Experience responding to security incidents in cloud environments.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">Proficiency with infrastructure as code (for example Terraform) and in at least one programming language used for automation (for example Python or Go).</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">A track record of leading cross-team technical initiatives and influencing engineering teams without direct authority.</span></li> <li style="font-size: 10pt;"><span style="font-size: 10pt;">History of setting technical direction for a security domain, including a multi-year roadmap and the decisions behind it<