Principal Cloud Security Engineer

Are you ready to lead the way in securing cloud environments for a vital public service We are looking for a highly skilled Principal Cloud Security Engineer to join the Digital Risk & Security branch of our Chief Digital Office. In this pivotal role your expertise will be instrumental in protecting Social Security Scotlands critical information systems supporting our commitment to safeguarding public data and digital services.

As a key technical leader you will drive the adoption and evolution of DevSecOps practices across a complex multi-cloud environment. Collaborating closely with cloud engineers developers and architects you will lead the design and integration of security tooling into our cloud environments ensuring security is embedded at every stage of our organisation. Your role will be pivotal in implementing secure-by-design cloud architectures delivering scalable automated solutions that align with industry best practices and support our wider digital transformation goals.

This is a highly technical role requiring a deep understanding of cloud infrastructure and advanced security expertise. You will play a critical part in articulating security postures managing technical risks and implementing controls to mitigate potential threats. While this role does not involve direct security operations or governance your developer experience and stakeholder management skills will be vital. You will collaborate across teams influence senior management and drive forward innovative security solutions that balance security needs with operational agility.

A Principal Cloud Security Engineer designs builds manages and supports the security controls within our infrastructure services that underpin all internal user services and services to the public.

The Principal Cloud Security Engineer manages third party provision of cloud security services and the provision of expertise to develop secure architectural solutions for our cloud infrastructure services throughout the service product life cycle.

At this role level you will:

• Oversee programmes and projects.
• Work with technical architects and infrastructure engineers to translate the architectural designs into operations and support in operationalising the designs.
• Lead and direct cloud security engineering teams in building managing supporting and maintaining solutions according to departmental policy (if taking a managerial path).

If you are passionate about cloud security and eager to make a real difference in public services we invite you to join our talented team and take the next step in your career.

Responsibilities

• Lead the design implementation and support of cloud infrastructure solutions with embedded security controls utilising industry-standard frameworks like AWS Well-Architected or Azure Security Centre.
• Develop and enforce security controls within Infrastructure as Code (IaC) pipelines integrating security testing (SAST DAST SCA) and automated compliance checks into CI/CD processes.
• Provide expert guidance on cloud security architecture articulating security postures and implementing mitigating controls to reduce risk.
• Lead cross-functional teams in applying modern development and security standards to support complex projects ensuring security by design.
• Proactively identify vulnerabilities and potential issues in cloud environments initiating preventative measures and continuous security improvements.
• Collaborate with Architects Developers and DevOps teams to embed security into the end-to-end development pipeline promoting DevSecOps best practices.
• Establish and maintain security frameworks and procedures across the service life-cycle ensuring compliance with standards such as ISO27001 and government policies.
• Diagnose and troubleshoot security and infrastructure issues across diverse systems including compute storage networking and software.
• Cultivate strong stakeholder relationships serving as the primary point of contact for cyber security matters and securing buy-in for security initiatives.
• Advise on emerging security threats and future technology trends supporting strategic planning and security posture enhancement.
• Lead system and acceptance testing strategies ensuring security controls are validated and operational risks are effectively managed.
• Lead the development of security awareness and training programmes to promote a strong security culture within technical teams.