Senior Software Engineer II, Cloud Security

At Qualia, we've built the leading B2B real estate technology that transforms the home buying and selling experience into a simple, secure, and enjoyable process. Our SMB and Enterprise products bring together users from across the real estate ecosystem—homebuyers and sellers, lenders, title and escrow agents, and real estate agents—onto a single shared digital closing platform, providing greater clarity and transparency to real estate transactions. Today, through our business customers across the country, millions of consumers use Qualia to close on homes every year. WHAT YOU'LL WORK ON Millions of consumers close on homes through Qualia every year, which means our cloud carries wire instructions, identity documents, and nonpublic financial data at scale. Cloud Security owns the security of the infrastructure that platform runs on: our AWS accounts and organization, Kubernetes clusters, identity and access paths into production, the CI/CD systems that deploy to it, and the detection and response signal that tells us when something is wrong. The team works alongside Application Security, SRE, Platform, and InfoSec. We're hiring a Senior Cloud Security Engineer who builds. Most of your week goes to writing code and infrastructure: Terraform modules, policy-as-code, Go services for detection and automation, and the integrations that wire them into how Qualia ships. You'll be one of two engineers on the Cloud Security team, working with its EM, so the patterns you set for AWS, Kubernetes, and production access become the ones the rest of engineering follows. You'll work closely with SRE and Platform day to day, and with Application Security wherever code and infrastructure meet. RESPONSIBILITIES • Harden AWS. Design and implement account structure, IAM roles and permission boundaries, network segmentation, and KMS usage, all in Terraform and Go • Secure Kubernetes. Ship admission policies, RBAC, network policies, workload identity, and runtime controls; keep container images minimal and patched • Build guardrails engineers want. Write hardened, reusable IaC modules and CI policy checks that make the secure path the easy one • Engineer detections. Build and tune cloud detections on CloudTrail, Kubernetes audit logs, and runtime signal; write the Go services and pipelines behind them and feed InfoSec's SIEM • Kill standing access. Implement just-in-time access, short-lived credentials, and secrets management for humans, services, and CI • Run posture to zero. Build and run our in-house posture checks in Go across AWS accounts and container images; fix root causes in code and automate the fix where the class repeats • Respond. Investigate cloud alerts and take the infrastructure side of incidents, then close the gap so it doesn't recur • Review and teach. Review infrastructure PRs and design proposals; pair with SRE and product engineers to land fixes YOUR BACKGROUND THAT LIKELY MAKES YOU A MATCH • 6+ years in cloud security, infrastructure, SRE, or platform engineering, with at least 3 focused on securing production cloud environments • Deep hands-on AWS: IAM policy evaluation, Organizations, VPC and private connectivity, KMS, CloudTrail, GuardDuty or equivalent • Production Kubernetes security: RBAC, admission control, network policy, pod security, and how workloads authenticate to cloud APIs • Strong Terraform (or similar IaC) — you write and review modules, and you've built guardrails other teams depend on • You write production code. Go preferred; Python or TypeScript welcome if you're ready to work in Go • You can explain how an attacker moves from a leaked credential or a compromised pod to sensitive data, and how you'd detect each step • Clear, direct writing: findings an engineer wants to fix and design doc