Staff Cloud Security Engineer

The Nuclear Company is the fastest growing AI tech-enabled startup in the nuclear and energy space, pioneering a fleet-scale approach to building the next generation of nuclear reactors. Through our design-once, build-many model, we're accelerating the deployment of safe, reliable, and affordable nuclear energy. We operate with an AI-first mindset. Every employee is expected to leverage AI, technology, and the Nuclear Operating System (NOS) as integral components of their role to improve the quality, speed, and impact of their work. We expect every team member to continuously identify opportunities to automate workflows, enhance decision-making, improve processes, and contribute to the ongoing evolution of NOS as a strategic operating capability that enables The Nuclear Company to scale with excellence. We hire people who are driven by purpose, thrive in ambiguity, and are energized by building what has never been built before.  Our team combines intellectual curiosity with high agency, embraces candid feedback and continuous learning, and holds themselves and others to exceptional standards. Our values— Transparency, Responsibility, Unity, Scrappiness, and Tenacity —guide how we hire, collaborate, and make decisions every day. They are not words on a wall; they are the standard by which we operate. TRUST is the foundation of our safety culture, fostering intellectual honesty, accountability, and open communication, while our values challenge every team member to execute with urgency, humility, resilience, and an unwavering commitment to our mission. About the role The Nuclear Company is searching for a  Cloud Security Engineer  to help secure the AWS cloud infrastructure, network architecture, identity systems, and deployment platforms that power our Nuclear Operating System, internal engineering platforms, data environments, and mission-critical business systems.   This is a high-ownership role for a hands-on security builder who is equally comfortable designing AWS account architecture, reviewing Terraform, hardening VPC and transit-network patterns, building IAM guardrails, debugging cloud logs, and partnering directly with engineers to ship secure infrastructure quickly.   You will work across cybersecurity, infrastructure, product engineering, platform engineering, data science, and operations to embed security into the way we design, deploy, monitor, and operate AWS-based systems. You will help define secure cloud architecture, implement security controls as code, build scalable guardrails, and support the security expectations of a regulated, high-consequence infrastructure company.   This role reports into  Senior Manager for Application and Product Security. Responsibilities AWS Security Architecture  Own and improve the security architecture for AWS environments that support The Nuclear Company’s engineering, product, data, and business systems.   Design and implement secure multi-account AWS patterns using AWS Organizations, service control policies, identity federation, account baselines, network segmentation, and centralized logging.   Establish cloud-security standards for IAM, encryption, secrets management, logging, backup, data protection, workload isolation, and incident response.   Partner with software developers and platform engineers to review and harden cloud-native services, including compute, storage, networking, databases, serverless workloads, containers, and managed AWS services.   Translate business, engineering, and regulatory requirements into practical AWS security controls that can scale with the company.   Identity, Access & Permissions   Build and maintain least-privilege access models for human users, workloads, service accounts, CI/CD systems, and third-party integrations. Harden AWS IAM, IAM Identity Center, role assumption patterns, permission boundaries, resource policies, and cross-account access. Reduce long-lived credentials, standing privileges, orphaned access, and excessive permissions across AWS environments.   Cloud Networking & Infrastructure Protection  Design and review secure AWS network architectures, including VPCs, subnets, routing, security groups, NACLs, transit gateways, private connectivity, VPNs, Direct Connect, PrivateLink, VPC endpoints, egress controls, and network inspection patterns.   Implement and improve protections for internet-facing and internal services, including WAF, DDoS protection, load balancers, API gateways, DNS, TLS, and edge controls.   Partner with infrastructure teams to define secure network segmentation between development, staging, production, corporate, partner, and sensitive data environments.   Infrastructure-as-Code, Automation & DevSecOps  Build security controls as code using Terraform, CDK, CloudFormation, policy-as-code, CI/CD checks, and automated remediation.   Review infrastructure-as-code changes for security risks before they reach production.  Establish paved roads for engineers through secure Terraform modules, reusable cloud patterns, baseline account templates, and documented deployment standards.   Detection, Logging & Incident Readiness  Build and improve cloud detection and response capabilities using AWS-native and third-party tooling, including CloudTrail, GuardDuty, Security Hub, Config, VPC Flow Logs, CloudWatch, IAM Access Analyzer, and SIEM integrations.   Ensure high-value cloud events, identity events, network activity, data-access events, and administrative actions are logged, retained, monitored, and actionable.  Develop cloud incident-response playbooks for credential exposure, unauthorized access, public data exposure, network compromise, suspicious workload behavior, and deployment-system compromise.   Support tabletop exercises, incident simulations, and post-incident reviews.   Governance, Risk & Critical Infrastructure Security  Help build a cloud-security program that supports the security