Job Summary:BJ's is seeking a Cloud Security Engineer to help secure and operate our cloud environments across AWS, Azure, and GCP. This is a hands-on engineering role responsible for evaluating cloud and application designs, operating cloud security tooling, and driving remediation of security findings in partnership with engineering and platform teams.
The Cloud Security Engineer plays a key role in strengthening cloud security posture by balancing security requirements with operational realities. This role is well-suited for an engineer who can work independently, apply sound technical judgment, and collaborate across teams to reduce risk and improve security outcomes at scale.
What You'll Do- Perform security architecture and design reviews for cloud services, applications, and technologies, providing clear and actionable guidance to engineering teams.
- Evaluate cloud designs for security controls including identity and access management, encryption, logging, monitoring, and network protections.
- Contribute to the definition and ongoing improvement of cloud security standards, reference architectures, and configuration baselines.
- Implement, operate, and tune security tooling used for visibility, monitoring, detection, and response across AWS, Azure, and GCP.
- Own the triage, validation, prioritization, and remediation tracking of cloud security findings generated by CSPM and related tooling.
- Partner with cloud, infrastructure, and application teams to ensure remediation is effective and sustainable.
- Identify opportunities to automate repetitive security tasks or control validations to improve efficiency, consistency, and scalability of cloud security operations.
- Support infrastructure hardening and patch compliance efforts across cloud and on-prem environments.
- Perform risk-based analysis of vulnerability findings, including false positive validation and remediation tracking.
- Work with platform and operations teams to improve vulnerability management and patching workflows over time.
- Review application designs and implementation patterns to ensure alignment with Secure SDLC and secure coding expectations.
- Support application security activities including static, dynamic, and dependency scanning and analysis.
- Assist development teams in understanding and remediating application security findings.
- Provide operational support for web application security technologies such as Web Application Firewalls (WAF) and related edge controls, including Akamai where applicable.
- Support certificate lifecycle management by maintaining inventory accuracy, tracking renewals, coordinating deployments, and reducing certificate-related risk.
- Contribute to improving certificate management processes, documentation, and visibility.
- Develop and maintain security documentation, runbooks, and standard operating procedures.
- Contribute to metrics and reporting that provide visibility into cloud and application security risk.
- Participate in security initiatives and continuous improvement efforts by contributing hands-on execution and technical insight.
What We're Looking ForRequired Qualifications:- Bachelor's degree in Computer Science, Information Security, or equivalent practical experience.
- 4-6 years of hands-on experience in cloud engineering, systems engineering, or security engineering roles.
- Experience securing workloads in AWS, Azure, and/or GCP.
- Strong understanding of cloud security controls including IAM, logging, monitoring, encryption, and threat detection.
- Experience operating security controls in highly available, production environments.
- Hands-on experience with scripting or automation (Python, Bash, PowerShell).
- Working knowledge of infrastructure-as-code or configuration management tools such as Terraform, CloudFormation, ARM, Puppet, or Ansible.
- Understanding of Secure SDLC concepts and common application security controls.
- Familiarity with security frameworks or compliance requirements such as NIST, PCI DSS, CIS, or ISO 27001.
- Strong communication skills and ability to collaborate effectively with engineering teams.
Nice to Have- Experience operating CSPM tooling and driving remediation of cloud configuration findings.
- Exposure to application security tools such as SAST, SCA, or DAST.
- Familiarity with certificate management platforms or enterprise PKI (e.g., DigiCert, AppViewX).
- Experience with edge or application security technologies such as Akamai Control Center or Akamai WAF.
- Prior involvement in vulnerability management or security operations programs.
- Experience with containerized environments (Docker required; Kubernetes preferred).
Preferred Certifications- CompTIA Security+
- AWS or Azure Security certifications
- CCSP
This is a hybrid role. Tuesday through Thursday are in-office days at BJ's Club Support Center in Marlborough, MA and Monday and Friday are remote days.
In accordance with the Pay Transparency requirements, the following represents a good faith estimate of the compensation range for this position. At BJ's Wholesale Club, we carefully consider a wide range of non-discriminatory factors when determining salary. Actual salaries will vary depending on factors including but not limited to location, education, experience, and qualifications. The pay range for this position is $100,000.00 - $131,500.00
We recognize the growing role of AI tools, including ChatGPT, and value familiarity with them. That said, we want to hear from your authentic self. Your application should reflect your own skills, experiences, and insights rather than AI-generated responses.
