Cloud Security Engineer (AWS & GCP)

About the role

Vitol is looking for a Cloud Security Engineer to join its Technology department. The role secures Vitol's AWS and Google Cloud (GCP) environments and the workloads running on them across its worldwide trading and physical operations. It builds and runs the controls that let engineering teams deliver in the cloud quickly and safely, acting as the practical link between security requirements and how cloud services are built and operated. The position works closely with the CISO organization, Developer Community Enablement, product engineering and local infrastructure teams.

Key responsibilities

• Design, deploy and operate security controls across AWS and GCP, covering posture management (CSPM), workload protection (CWPP), identity and entitlements (CIEM) and network security.
• Engineer and operate cloud security platforms such as Wiz, CrowdStrike Cloud Security and Palo Alto Networks: onboard accounts and projects, tune policies and route findings into existing workflows.
• Define and maintain secure baselines for AWS accounts and GCP projects, including organization policies, IAM, encryption, logging and network segmentation.
• Secure container workloads on EKS and GKE, from image build through to runtime.
• Protect sensitive data in the cloud and reduce the risk of data exfiltration.
• Prioritize cloud vulnerabilities and misconfigurations by risk, drive remediation with owning teams and support incident investigation and response.
• Embed security checks in CI/CD pipelines (IaC scanning, SAST, secret detection, image scanning), maintain policy as code and review Terraform modules.
• Automate remediation, evidence collection and reporting through scripting and APIs.
• Build dashboards and KPIs on cloud security posture, present them in governance forums and guide engineering teams on implementing controls.

Required profile

• Undergraduate or postgraduate degree in a technical discipline, or equivalent experience.
• 5+ years of hands-on experience securing workloads in AWS and GCP, with depth in at least one and working knowledge of the other.
• Fluent English; good French is an advantage.

Required skills

• Hands-on experience with at least one cloud-native application protection platform (Wiz, CrowdStrike Cloud Security, Palo Alto Networks Prisma Cloud / Cortex Cloud).
• Strong knowledge of AWS and GCP security controls (IAM, key management, organization policies, logging, network controls).
• Terraform and securing CI/CD pipelines.
• Python or a similar scripting language.
• Container and Kubernetes security, and application security fundamentals including the OWASP Top 10.
• Advantage: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, CKS, CISSP, CCSP or vendor certifications; CIS Benchmarks, NIST, ISO 27001; commodity trading or financial services background.

What we offer

• The chance to secure high-stakes cloud workloads across 40+ offices and mission-critical trading systems.
• Direct influence on how cloud security is designed and run, shaping standards and tooling.
• A flat, meritocratic culture with rapid decision-making and minimal bureaucracy.
• Work with colleagues across Vitol's global network in Geneva, London, Houston, Singapore and beyond.