Cloud Security Engineer

Company Description

Vitol is a leader in the energy sector with a presence across the spectrum: from oil through to power, renewables and carbon. From 40 offices worldwide, we seek to add value across the energy supply chain, including deploying our scale and market understanding to help facilitate the energy transition. To date, we have committed over $2 billion of capital to renewable projects, and are identifying and developing low-carbon opportunities around the world.

Our people are our business. Talent is precious to us and we create an environment in which individuals can reach their full potential, unhindered by hierarchy. Our team comprises more than 65 nationalities and we are committed to developing and sustaining a diverse work force. Learn more about us here.

Job Description

Vitol is seeking a Cloud Security Engineer to join its Technology department. The role is
accountable for securing Vitol's AWS and Google Cloud (GCP) environments, and the workloads
that run on them, across our worldwide trading and physical operations.
The Cloud Security Engineer will build and run the controls that let engineering teams deliver in
the cloud quickly and safely, using platforms such as Wiz, CrowdStrike, Palo Alto Networks and
other CSPM. The role is the practical link between security requirements and the way cloud
services are built and operated.
The Cloud Security Engineer will work closely with the CISO organization, Developer Community
Enablement, product engineering and local infrastructure teams globally.
Key areas of responsibility for the Cloud Security Engineer include:

• Cloud Security Controls: Design, deploy, and operate security controls across AWS and GCP, covering posture management (CSPM), workload protection (CWPP), identity and entitlements (CIEM), and network security.
• Security Platform Engineering: Engineer and operate cloud security platforms such as Wiz, CrowdStrike Cloud Security, and Palo Alto Networks: onboard accounts and projects, tune policies, and route findings into existing workflows.
• Baselines & Guardrails: Define and maintain secure baselines for AWS accounts and GCP projects, including organization policies, IAM, encryption, logging, and network segmentation.
• Containers & Kubernetes: Secure container workloads on EKS and GKE, from image build through to runtime.
• Data Protection: Protect sensitive data in the cloud and reduce the risk of data exfiltration.
• Vulnerability Management & Incident Response: Prioritize cloud vulnerabilities and misconfigurations by risk, drive remediation with the owning teams, and support the Cyber Security & Assurance teams in the investigation of and response to cloud security incidents.
• DevSecOps: Embed security checks in CI/CD pipelines (infrastructure-as-code scanning, SAST, secret detection, and image scanning), maintain policy as code, and review Terraform modules for security.
• Automation: Automate remediation, evidence collection, and reporting through scripting and APIs.
• Governance & Guidance: Build dashboards and KPIs on cloud security posture, present them in governance forums, and give engineering teams practical guidance on implementing controls.

Qualifications

• Education: Undergraduate or postgraduate degree in a technical discipline (Computer Science, Engineering, Information Security, or a related field), or equivalent experience.
• Cloud Security Experience: 5+ years of hands-on experience securing workloads in AWS and GCP, with depth in at least one and working knowledge of the other.
• Security Platforms: Hands-on experience with at least one cloud-native application protection platform, such as Wiz, CrowdStrike Cloud Security, or Palo Alto Networks Prisma Cloud / Cortex Cloud.
• Native Cloud Controls: Strong knowledge of AWS and GCP security controls, including IAM, key management, organization-level policies, logging, and network controls.
• Infrastructure as Code & CI/CD: Experience with Terraform and with securing CI/CD pipelines.
• Scripting & Automation: Proficiency in Python or a similar language.
• Containers & Application Security: Understanding of container and Kubernetes security, and of application security fundamentals including the OWASP Top 10.
• Data Protection: Experience protecting sensitive data and mitigating data exfiltration risk.
• Certifications: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), CISSP, CCSP or vendor certifications from Wiz, CrowdStrike, or Palo Alto Networks are an advantage.
• Frameworks & Industry: Working knowledge of CIS Benchmarks, NIST, and ISO 27001, and familiarity with commodity trading or financial services environments, are an advantage.
• Languages: Fluent English required and good knowledge of French an advantage

Additional Information

Soft Skills that will help you stand out

• Autonomous & Proactive: Understands functional and technical requirements, spots gaps, and proposes improvements without waiting to be asked.
• Clear Communicator: Explains technical risk in business terms to engineers and non-technical stakeholders alike.
• Highly Collaborative: Builds trust with engineering teams and treats security as something that enables delivery.
• Pragmatic & Outcome-Oriented: Prioritizes by risk and focuses on fixes that measurably reduce exposure.
• Decisive & Action-Oriented: Comfortable setting priorities and delivering at pace in a flat, high-ownership culture.
• Intellectually Curious: Keeps up with new cloud services and the threats that come with them.

What We Offer

• Scale and Complexity: The opportunity to secure demanding, high-stakes cloud workloads across 40+ offices and mission-critical trading systems.
• Modern Security Stack: Hands-on work with leading cloud security platforms across AWS and GCP.
• Real Ownership: Direct influence on how cloud security is designed and run at Vitol, with room to shape standards and tooling.
• Flat, Meritocratic Culture: A non-hierarchical environment where good ideas win on merit, decisions are made rapidly, and bureaucracy is strictly minimized.
• Global Footprint: Work with diverse, highly talented technology and business colleagues across Vitol's global network in Geneva, London, Houston, Singapore, and beyond.