Security Engineer Attack Surface Platforms (Hybrid)

·    Monitor CNAPP queues, dashboards, alerts, and platform health. Review new and aging findings, identify duplicates or data quality issues, and route actionable items to the appropriate cloud, platform, application, or security owner.

·    Triage cloud misconfigurations, vulnerabilities, exposed assets, excessive permissions, and workload or container risks. Use asset context, exploitability, business criticality, and available threat information to validate severity and recommend an appropriate response.

·    Investigate findings by reviewing cloud configurations, resource relationships, platform evidence, and available logs or metadata. Document the technical basis, affected resources, recommended remediation, and any applicable exception or compensating control.

·    Coordinate remediation with engineering and service teams. Track progress against agreed service targets, follow up on overdue or recurring issues, validate fixes in the CNAPP platform, and escalate material or time-sensitive exposure through established processes.

·    Administer and support CNAPP capabilities, including user and role access, cloud account and subscription onboarding, integrations, asset inventory, notification routes, policy configuration, and platform settings.

·    Improve platform coverage and signal quality by tuning existing policies, adjusting thresholds, testing new or changed detections, and reviewing false positives, missed coverage, and recurring finding patterns with the relevant security and engineering partners.

·    Build and test modest platform enhancements such as custom policies, dashboards, reports, API-based utilities, workflow changes, or integrations. Maintain clear change notes and supporting procedures, and follow the organization’s change and release practices.

·    Prepare operational reporting on exposure trends, remediation status, platform coverage, finding quality, and service health. Explain notable changes and data limitations so teams can act on the results.

·    Contribute to security risk assessments, cloud security reviews, incident investigations, and audit evidence requests involving CNAPP data or cloud attack surface exposure.

·    Maintain runbooks and knowledge articles for recurring operational tasks. Share platform guidance with users and help improve support handoffs and repeatable triage practices.

Partners with Cloud Engineering, Platform Engineering, DevOps, application teams, Security Operations, Security Architecture, and other technology groups to resolve exposure and maintain effective CNAPP operations. Communicates clearly with technical and business stakeholders and works with platform vendors when troubleshooting or evaluating product capabilities.

·    Working knowledge of at least one major cloud platform, including its core services and terminology; experience across multiple cloud platforms is useful.

·    Understanding of CNAPP capabilities and related areas such as cloud security posture management (CSPM), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM), vulnerability management, and container security.

·    Ability to interpret cloud assets, identities and permissions, network exposure, vulnerabilities, and configuration findings, then explain risk and remediation steps to engineering teams.

·    Experience with security operations practices such as alert or finding triage, ticket ownership, prioritization, escalation, remediation tracking, and evidence-based closure.

·    Ability to troubleshoot SaaS security platforms, integrations, data ingestion, policy behavior, access, and reporting issues in partnership with platform or cloud administrators.

·    Basic scripting or API experience in a language such as Python, PowerShell, or Bash to support investigation, data checks, or small platform enhancements. Infrastructure as Code experience is useful but is not the primary focus of this role.

·    Strong written and verbal communication, attention to detail, sound judgment when handling security findings, and the ability to manage multiple operational priorities.

Generally requires a bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent practical experience.

Typically requires 2–3 years of experience in information security, cloud security, security operations, cloud engineering, or a related technical role. Experience supporting a CNAPP or comparable cloud security platform is preferred.

Candidates must hold an introductory cloud or cloud security certification at the time of selection. Accepted certifications include AWS Certified Cloud Practitioner, Microsoft Certified: Azure Fundamentals, Google Cloud Digital Leader, or the Certificate of Cloud Security Knowledge (CCSK) from the Cloud Security Alliance. An equivalent foundational certification may be accepted with manager approval.

First American will consider for employment all qualified applicants, including those with arrest or conviction records, in a manner consistent with the requirements of applicable state and local laws (e.g., the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act).

First American intends to conduct a review of an applicant’s criminal history in connection with a conditional offer. First American reasonably believes that a criminal history may have a direct, adverse and negative relationship with the following material job duties for this position potentially resulting in the withdrawal of the conditional offer of employment: handling of confidential, proprietary or trade secret information belonging to First American or its customers, administrating or facilitating financial transactions, and the ability to meet customer-imposed criminal history requirements.