Principal Cloud Security Engineer

, and how to manage your#
** About Invesco
** As one of the world’s leading independent global investment firms, Invesco is dedicated to rethinking possibilities for our clients. By delivering the combined power of our distinctive investment management capabilities, we provide a wide range of investment strategies and vehicles to our clients around the world. If you're looking for challenging work, intelligent colleagues, and exposure across a global footprint, come explore your potential at Invesco.#
** The Department
** Our Information Security department is to protect Invesco’s information and Information assets from all internal and external, deliberate, or accidental threats. The information security team will protect data from unauthorized access while maintaining the confidentiality, integrity, and availability of information. In addition, designing and maintaining the Security Policies and Standards while adhering to legislative and regulatory requirements, providing information security training for all employees, and ensuring the business continuity of Invesco.
** Your Role
** Principal Engineer Cloud Security will work closely with technology and application teams to help them secure their cloud environment.  In this role, you will partner with Infrastructure teams to provide secure cloud requirements, and ensure the solutions and infrastructure are securely designed, developed, and implemented, while enforcing conformity with technical standards and approved cloud security architectures that align to regulatory and compliance standards.
** You will be responsible for:
*** Designing, configuring, and implementing secure solutions for the firm’s global cloud infrastructure in partnership with architects and engineering teams.
* Defining cloud security technical requirements, including IAM, network segmentation, data protection, container security, workload protection, CI/CD security, Kubernetes, microservices, SIEM integrations, and more.
* Developing security patterns and controls for Data Loss Prevention (DLP) across cloud, endpoint, and SaaS environments—including policies, detection tuning, and data governance alignment.
* Driving SaaS Security strategy, including secure configuration baselines, CASB/CSPM integrations, continuous monitoring, and third‐party SaaS risk assessment.
* Strategizing and maturing cloud security solutions to improve compliance with the NIST Cybersecurity Framework, Cloud Security Alliance guidance, and Invesco policies.
* Developing and deploying infrastructure‐as‐code to automate and optimize cloud security controls.
* Providing technical support for patches, upgrades, incident response, and operational improvements.
* Performing security threat modeling and design reviews for emerging cloud and SaaS technologies.
** The experience you bring:
*** 10+ years of information security experience supporting enterprise‐scale security engineering and architecture programs.
* 5+ years designing and implementing enterprise cloud security solutions across AWS, Azure, Oracle, and other major cloud providers.
* Experience with Terraform for deployment automation, orchestration, and security configuration management.
* Proficiency in scripting (Python, Power Shell, JSON).
* Experience developing and institutionalizing security standards, blueprints, and patterns aligned to frameworks such as SOX, CSA-CCM, DORA, NIST, ISO, GDPR, and SOC1/2.
* Hands‐on experience with Data Loss Prevention programs, including policy creation, tuning, incident handling, and integrating DLP with cloud and SaaS platforms.
* Experience with SaaS Security technologies, such as CASB, SSPM (SaaS Security Posture Management), and SaaS risk assessment frameworks.
* Knowledge of cloud and endpoint security tools such as Crowd Strike and Wiz.
* Hands‐on experience with AWS native security services including Control Tower, Cloud Watch, Guard Duty, Cloud Trail, Config, Lambda, Trusted Advisor, AWS Organizations, Transit Gateway, AWS SSO, and others.
* Extensive experience with AWS services including EC2, IAM, Route
53, SSM, S3, EFS, EBS, ELB, EKS, ECS, Lambda, Cloud Formation, Cloud Front, Dynamo

DB, Athena, Kinesis, and…