Principal Security Engineer, Cloud Security

As a Principal Product Security Engineer, Cloud Security, you will be the technical architect and engineer driving the architecture and and strategic SME driving cloud security architecture, automation, and secure-by-default platforms across Atlassian's global footprint. You will define the technical vision, establish architectural standards, and lead cross-organizational initiatives that equip engineering teams with state-of-the-art tools, patterns, and guardrails to build secure products by default. Partnering closely with security leadership, principal architects, and platform engineering teams, you will champion strategic programs that uplift and scale our security posture across multi-cloud environments. Some of your key responsibilities will include:

• Strategic Architecture & Secure Design: Define and steer the overarching security architecture for multi-cloud platforms (AWS, GCP, Azure), setting company-wide secure-by-default standards, architectural patterns, and guardrails for cloud-native services and core platforms.

• Complex Threat Modeling & High-Impact Assessments: Drive advanced threat modeling and deep-dive security assessments across critical, complex systems, distributed microservices, and high-assurance environments (such as Isolated, Private, and Regulated/FedRAMP offerings).

• Platform Automation & Guardrails at Scale: Architect, champion, and scale automated security controls, detection capabilities, and self-healing guardrails embedded directly into CI/CD pipelines and infrastructure as code (IaC), systematically eliminating classes of vulnerabilities.

• Continuous Posture Optimization & CSPM Strategy: Set the technical direction for Cloud Security Posture Management (CSPM) and posture analytics, driving continuous compliance, maturing security baselines, and providing leadership visibility into systemic risk.

• Operational & Architectural Excellence: Establish company-wide reusable security frameworks, engineering guidelines, and operational standards that improve resilience, reliability, and security performance across Atlassian products.

• Technical Leadership & Mentorship: Serve as a technical sponsor and mentor for security and software engineers across the organization, fostering an inclusive culture of engineering excellence, security advocacy, and cross-team capability uplift.

• Critical Incident Advisory & Architectural Remediation: Act as the principal cloud security authority during high-severity security incidents, partnering with Incident Response to conduct root-cause investigations, formulate long-term architectural mitigations, and prevent recurrence.

• Executive & Stakeholder Influence: Translate complex cloud security risks and technical roadmaps into strategic priorities for executive and non-technical stakeholders, driving consensus and cross-functional alignment on mission-critical security initiatives.

On Your First Day, We'll Expect You To Have

• 10+ years of experience in security engineering with deep specialization in cloud security, secure architecture, and platform security at enterprise or hyper-growth SaaS scale.

• Proven track record as a technical authority or principal engineer driving large-scale security architectures, risk mitigations, and threat modeling initiatives across complex SaaS and cloud-native systems.

• Deep, hands-on expertise in multi-cloud security (AWS, GCP, and/or Azure) and container orchestration ecosystems (Docker, Kubernetes, service mesh).

• Extensive experience designing, securing, and conducting comprehensive architectural reviews for highly regulated, high-assurance cloud environments (such as Isolated, Private, Government, and FedRAMP offerings).

• Demonstrated experience guiding broad architectural transformations, including overseeing security strategy for monolith-to-microservices migrations.

• Strong proficiency in at least one modern programming language (such as Python, Go, Java, or JavaScript) and proven experience authoring scalable security automation, tooling, and infrastructure as code (IaC).

• Deep experience embedding automated security controls, policy-as-code, and compliance gates into modern CI/CD pipelines.

• Exceptional technical communication and executive influence, with a demonstrated ability to align diverse engineering teams, architects, and senior leadership around strategic security goals.

• Proven track record of mentoring and coaching senior engineers and cultivating an inclusive, collaborative engineering culture.

Required:

• Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field (or equivalent practical experience).

• Deep architectural mastery of cloud security, zero trust architecture, tenant data isolation, cryptographic systems/encryption, and multi-tenant SaaS environments at enterprise scale.

• Proven track record designing and driving infrastructure as code (IaC) governance, centralised secrets management, and embedding automated security guardrails across the entire software development lifecycle (SDLC).

• Deep understanding of cloud detection engineering, distributed telemetry/logging, IAM graph analysis, least-privilege policy automation, and enterprise alert optimisation.

• Demonstrated ability to champion developer velocity and engineering experience (DevEx) while establishing robust, non-negotiable security guardrails.

• Exceptional communication, technical leadership, and stakeholder influence across both executive leadership and engineering teams.

It's great, but not required if you have:

• Extensive experience architecting and building scalable internal software platforms or developer tooling that automate security and compliance workflows.

• Discovered and disclosed notable CVEs, or active maintainership/contributions to open-source security tooling and frameworks.

• Delivered presentations at recognized industry security conferences (e.g., Black Hat, DEF CON) or published security research.

• Deep hands-on experience securing modern serverless architectures, service meshes, and large-scale container orchestration platforms (Kubernetes).

• Experience architecting security controls for highly regulated cloud environments (such as FedRAMP, Isolated, or Sovereign Cloud offerings).

You’ll Thrive Here If You

• Take ownership of outcomes and drive projects to completion.

• Are proactive in identifying and mitigating security risks.

• Enjoy collaborating across teams and mentoring others.

• Communicate clearly and adapt your message to your audience.

• Are passionate about scaling security through automation and best practices.

Benefits & Perks

Atlassian offers a wide range of perks and benefits designed to support you, your family and to help you engage with your local community. Our offerings include health and wellbeing resources, paid volunteer days, and so much more. To learn more, visit go.atlassian.com/perksandbenefits.

About Atlassian

At Atlassian, we're motivated by a common goal: to unleash the potential of every team. Our software products help teams all over the planet and our solutions are designed for all types of work. Team collaboration through our tools makes what may be impossible alone, possible together.

We believe that the unique contributions of all Atlassians create our success. To ensure that our products and culture continue to incorporate everyone's perspectives and experience, we never discriminate based on race, religion, national origin, gender identity or expression, sexual orientation, age, or marital, veteran, or disability status. All your information will be kept confidential according to EEO guidelines.

To provide you the best experience, we can support with accommodations or adjustments at any stage of the recruitment process. Simply inform our Recruitment team during your conversation with them.

To learn more about our culture and hiring process, visit go.atlassian.com/crh.

In line with local law, identity verification (which may include use of biometric data) is a condition of employment with Atlassian for employment fraud purposes.