# Staff Engineer, Cloud Security at Toast

> Remote · United States · Staff · Security · open. Source: https://alderhq.app/jobs/greenhouse%3Atoast%3A8267000 (read 2026-11-15).

## Facts (observed)

- Company: [Toast](https://alderhq.app/companies/toast)
- Location text: Remote, US; Remote - USA
- Where it can be done from (inferred): Remote · United States (evidence: "Location: Remote, US; Remote - USA")
- Posted: 2026-10-20 (25 days ago)
- First seen by alder: 2026-11-02 · last verified: 2026-11-15
- Reposted: 0 times · edited: 0 times
- Apply on the employer's site: https://careers.toasttab.com/jobs?gh_jid=8267000
- Skills listed (inferred): Python, AWS, GCP, Azure, Kubernetes, Docker, Terraform

## Pay and sponsorship

- Posted pay: $193k–$309k per year (from the listing's pay field)
- Market band for similar posted roles (United States, n 262): p25 $180k, median $223k, p75 $254k
- H-1B filings at this company for similar roles, FY26: 16, median offered wage $174k ([US DOL OFLC LCA disclosure data](https://www.dol.gov/agencies/eta/foreign-labor/performance))
- Licensed UK sponsor: registered as "Toast (Mail Order) Limited" (checked 2026-11-09, [register](https://www.gov.uk/government/publications/register-of-licensed-sponsors-workers))

## Description (the employer's text)

Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.

The Product & Platform Security team at Toast protects the cloud infrastructure and services that restaurants depend on every day. We are looking for a Staff Engineer, Cloud Security to expand the scope and coverage of our cloud security capabilities. You will join an existing cloud security team and take a role in setting direction for how Toast secures its cloud environments. This is a hands-on role with technical leadership responsibilities: you will build and operate security tooling and controls yourself, while also shaping strategy, mentoring teammates, and influencing the roadmaps of engineering teams across R&D.

Our footprint is primarily AWS. You will work closely with Platform and Infrastructure teams in R&D, and with Defense & Response and other Security Engineering teams within Trust & Security.

A day in the life (Responsibilities)

- Own and operate our Cloud-Native Application Protection Platform (CNAPP), including tuning, coverage, integrations, and turning findings into prioritized, actionable work for engineering teams.
- Lead cloud security posture management (CSPM) across our AWS organization and accounts, defining standards and measuring adherence over time.
- Drive identity and access management improvements, including least privilege, role and permission design, and reducing standing access.
- Secure our container environments, from image and workload security to cluster configuration and runtime protection.
- Build guardrails and secure defaults into infrastructure as code and deployment pipelines, so that teams get secure configurations by default rather than through review.
- Perform secure architecture reviews and threat modeling for new and existing cloud services and platform capabilities.
- Partner with our SOC on cloud detection coverage, logging, and investigation readiness.
- Run and improve cloud vulnerability and misconfiguration remediation programs, working with engineering owners to drive risk down.
- Participate in security incident response, including on-call coverage, and lead the cloud side of investigations and follow-up work.
- Set the multi-year direction for cloud security at Toast, and mentor and uplevel other engineers on the team.
- Build trusted relationships with Platform, Infrastructure, and product engineering leaders, and influence their priorities through data and clear risk communication.
What you'll need to thrive (Requirements)

- 8+ years of experience in security engineering, infrastructure, or software engineering, with significant time focused on cloud security.
- Deep, hands-on experience securing AWS environments at scale, including IAM, Organizations, networking, logging, and core security services.
- Experience deploying and operating cloud security tooling, such as CNAPP or CSPM platforms (for example Orca, Wiz, or Upwind).
- Experience with container and Kubernetes security (for example EKS).
- Experience performing threat modeling and security architecture reviews for cloud services and platform capabilities.
- Experience responding to security incidents in cloud environments.
- Proficiency with infrastructure as code (for example Terraform) and in at least one programming language used for automation (for example Python or Go).
- A track record of leading cross-team technical initiatives and influencing engineering teams without direct authority.
- History of setting technical direction for a security domain, including a multi-year roadmap and the decisions behind it
- Clear written and verbal communication, including explaining risk and tradeoffs to engineers and leaders.
What will help you stand out (Nonessentials/Nice to Haves)

- Experience with GCP, Azure, or other cloud platforms.
- Experience with cloud detection engineering or incident response in cloud environments.
- Familiarity with compliance frameworks relevant to payments and SaaS, such as PCI DSS or SOC 2.

---
Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/greenhouse%3Atoast%3A8267000 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.