Lead Cloud Governance Engineer

Writing, testing, and deploying complex Rego policies (for OPA) or Sentinel policies to enforce security, cost, and compliance guardrails across our cloud environments and CI/CD pipelines.

Developing reusable, governed Terraform modules, implementing cost and security checks using tools like `tfsec` or `checkov`, and architecting our IaC module registry and state management strategy.

Building custom reports and dashboards, configuring budgets and alerts, modelling cost scenarios for new projects, and driving rightsizing recommendations with engineering teams.

Configuring security policies, investigating complex cross-service vulnerabilities, tuning alert sensitivity to reduce noise, and integrating CSPM outputs into our incident response workflows.

Designing automated workflows (e.g., new account provisioning, remediation tracking), mapping cloud controls to compliance frameworks, and ensuring audit evidence is easily retrievable.

Architecting our multi-account/subscription strategy, automating account vending using Control Tower or Landing Zones, and writing/assigning native cloud policies to enforce organisational standards.

Writing custom automation scripts for governance tasks, integrating various cloud APIs, and building custom tooling where off-the-shelf solutions don't quite fit.

• Cloud Platform Engineering Leads
• Security Operations & Architecture Teams
• Finance Business Partners
• Product Engineering Teams (DevOps, SRE)
• Internal Audit & Compliance Teams

• Cloud Service Provider Account Teams (AWS, Azure, GCP)
• Third-party security and compliance tool vendors
• External auditors (e.g., for ISO 27001, PCI-DSS)

Organisations are increasingly multi-cloud, but governance tools often lag. You'll need to architect solutions that provide consistent policy enforcement and reporting across disparate cloud providers, potentially using federated OPA or custom abstraction layers.

Cross-cloud identity and access management (IAM) f · Centralised policy management for distributed enfo · Standardising resource tagging and metadata across · Building custom integrations between cloud-native · Designing a unified compliance reporting framework

• This quarter: Take a deep dive into the policy engines of your secondary cloud provider (e.g., Azure Policy if you're AWS-heavy).
• Next quarter: Design a conceptual framework for how you would apply a single security policy across both AWS and Azure using OPA.
• Month 6: Implement a proof-of-concept for cross-cloud tagging validation.
• Ongoing: Follow industry leaders and open-source projects focused on multi-cloud governance.

Quick win: Identify one simple policy (e.g., 'all storage must be encrypted') and document how you would enforce it in both AWS and Azure, highlighting similarities and differences.

Reactive security is no longer enough. You'll need to proactively test your governance controls by simulating attacks or misconfigurations, and build robust threat models to identify gaps before they're exploited.

Principles of chaos engineering applied to securit · Designing and executing 'game days' to test policy · Threat modelling methodologies (e.g., STRIDE, DREA · Integrating security testing into CI/CD pipelines · Automated incident response playbooks triggered by

• This quarter: Read up on security chaos engineering principles and case studies.
• Next quarter: Design a 'game day' scenario to test a critical IAM policy or network segmentation rule.
• Month 6: Work with the security team to implement a small-scale security chaos experiment against a non-production environment.
• Ongoing: Participate in threat modelling workshops for new cloud services or architectures.

Quick win: Start by documenting a simple threat model for a new cloud application, focusing on where your existing governance controls would (or wouldn't) prevent an attack.