Engineering Manager II, Cloud Security

At Qualia, we've built the leading B2B real estate technology that transforms the home buying and selling experience into a simple, secure, and enjoyable process. Our SMB and Enterprise products bring together users from across the real estate ecosystem—homebuyers and sellers, lenders, title and escrow agents, and real estate agents—onto a single shared digital closing platform, providing greater clarity and transparency to real estate transactions. Today, through our business customers across the country, millions of consumers use Qualia to close on homes every year. WHAT YOU'LL WORK ON Millions of consumersclose on homes through Qualia every year, which means our cloud carries wire instructions, identity documents, and nonpublic financial data at scale. Cloud Security owns the security of the infrastructure that platform runs on: our AWS accounts and organization, Kubernetes clusters, identity and access paths into production, the CI/CD systems that deploy to it, and the detection and response signal that tells us when something is wrong. The team works alongside Application Security, SRE, Platform, and InfoSec. We're hiring a player-coach Engineering Manager to build and lead Qualia's Cloud Security team. You'll set the direction for how we secure AWS, Kubernetes, and the paths into production, hire the two senior engineers who'll do it with you, and stay close enough to the work to review a Terraform plan or an IAM policy yourself. The mandate is to make the secure configuration the default one. That means guardrails, organization-level policy, paved-road modules that product teams adopt, and detection that catches drift and abuse in minutes. Where AI can take the first pass on posture findings, access reviews, or alert triage, you'll make that the normal workflow. RESPONSIBILITIES • Lead and grow the team. Hire, coach, and set goals for Cloud Security engineers; own delivery against the roadmap • Own cloud security architecture. Set standards for AWS account structure, network segmentation, encryption, and workload isolation across our Kubernetes clusters • Run identity and access for production. Drive least privilege across human and machine identities: SSO into AWS, role design, just-in-time access, and secrets management • Ship guardrails as code. Service control policies, admission control, policy-as-code checks in CI, and hardened Terraform modules that stop whole classes of misconfiguration • Own posture management. Build our posture checks in-house, in Go and policy-as-code, across cloud resources and container images; turn findings into a prioritized, owned queue that burns down • Build detection and response. Partner with SRE on cloud-native detection (CloudTrail, audit logs, runtime signal) and lead the cloud side of incident response • Secure the delivery pipeline. Protect CI/CD, artifact provenance, and deploy credentials as production assets • Partner across engineering. Review proposals; represent Cloud Security in SOC 2 and customer security reviews YOUR BACKGROUND THAT LIKELY MAKES YOU A MATCH • 7+ years in security, infrastructure, or platform engineering on production cloud systems, with 2+ years managing or leading engineers • Deep hands-on AWS security: IAM and Organizations, VPC design, sops, logging, and the services that carry sensitive data • Production Kubernetes security experience: RBAC, network policy, admission control, workload identity, and container image hygiene • Infrastructure-as-code fluency (Terraform or similar) and a record of shipping guardrails engineers adopted • You've built or scaled a cloud security function, or a major part of one, and can show what changed because of it • Strong written communication: you can write the architecture standard, the incident post-