Cloud Security Engineer

About Stitch Fix, Inc.

Stitch Fix (NASDAQ: SFIX) is the leading online personal styling service that helps people discover the styles they will love that fit perfectly so they always look - and feel - their best. Few things are more personal than getting dressed, but finding clothing that fits and looks great can be a challenge. Stitch Fix solves that problem. By pairing expert stylists with best-in-class AI and recommendation algorithms, the company leverages its assortment of exclusive and national brands to meet each client's individual tastes and needs, making it convenient for clients to express their personal style without having to spend hours in stores or sifting through endless choices online. Stitch Fix, which was founded in 2011, is headquartered in San Francisco.

About the Team

Our Security Architecture team is at the forefront of protecting our cloud infrastructure and applications. We are responsible for designing and implementing security solutions across cloud environments and application security domains to ensure the protection of sensitive data, prevent security threats, and enable secure innovation. We work closely with engineering, DevOps, and product teams to integrate security seamlessly into cloud-native architecture, DevSecOps pipelines, and application development workflows.

About the Role

As a Senior Cloud Security Engineer, you will play a critical role in both cloud security and application security, helping to secure AWS cloud environments, microservices, containers, serverless architectures, and application security pipelines. You will work closely with the Senior Security Architect and cross-functional teams to develop security solutions that mitigate risk while enabling business and engineering agility. This role requires expertise in cloud security architecture, DevSecOps automation, application security best practices, and incident response.

You're excited about this opportunity because you will…

• Design secure cloud and application architectures, ensuring security is embedded in both infrastructure and software development.
• Integrate security automation into CI/CD pipelines and enforcing secure coding practices.
• Work with engineering and product teams to proactively mitigate application security risks.
• Design and manage AWS multi-account environments, ensuring minimal attack surface and robust logging/monitoring.
• Implement AWS security best practices, leveraging services like GuardDuty, Security Hub, Inspector, and custom Lambda scripts for continuous threat detection.
• Develop secure IaC templates (Terraform/CloudFormation) to enforce consistent security configurations.
• Automate security controls to detect misconfigurations, vulnerabilities, and compliance violations (CIS, NIST, PCI-DSS).
• Integrate application security testing (SAST, DAST, SCA, IAST) into CI/CD pipelines to detect vulnerabilities early.
• Define secure coding guidelines and collaborate with engineering teams to ensure adherence.
• Conduct threat modeling and secure code reviews to proactively mitigate application security risks.
• Enforce API security best practices, including OAuth, JWT, rate limiting, and input validation.
• Work closely with the Senior Security Architect to align cloud and application security with overarching security standards.
• Partner with engineering, DevOps, and product teams to embed security into the SDLC and cloud infrastructure.
• Educate development teams on secure coding, application security testing, and cloud security best practices.

We’re excited about you because…

• You have 7+ years of experience in cloud security, DevSecOps, or application security, with a focus on AWS.
• You are an expert in AWS security services such as GuardDuty, Security Hub, Inspector, IAM, KMS, and AWS Organizations.
• You have deep experience with Infrastructure as Code (IaC), including Terraform and CloudFormation, to enforce security at scale.
• You have a strong understanding of application security principles, including OWASP Top 10, SAST, DAST, and secure SDLC methodologies.
• You are proficient in DevSecOps tooling, such as SAST, DAST, SCA, IAST, and container security scanning tools.
• Expert-level AWS knowledge: VPC design, IAM, KMS, EKS, Lambda, AWS Organizations.
• You have experience securing APIs, microservices, and serverless functions, ensuring proper authentication and authorization.
• You are a proactive problem solver, able to diagnose security challenges across both cloud and application layers.
• You have excellent communication and collaboration skills, allowing you to effectively advise engineering and product teams on security best