Security Engineer Attack Surface Platforms (Hybrid)

Who We Are

Join a team that puts its People First! Since 1889, First American (NYSE: FAF) has held an unwavering belief in its people. They are passionate about what they do, and we are equally passionate about fostering an environment where all feel welcome, supported, and empowered to be innovative and reach their full potential. Our inclusive, people-first culture has earned our company numerous accolades, including being named to the Fortune 100 Best Companies to Work For® list for eleven consecutive years. We have also earned awards as a best place to work for women, diversity and LGBTQ+ employees, and have been included on more than 50 regional best places to work lists. First American will always strive to be a great place to work, for all. For more information, please visit www.careers.firstam.com.

What We Do

The Security Engineer – Attack Surface Platforms operates and improves the organization’s cloud native application protection platform (CNAPP) and related attack surface capabilities. The role reviews and triages findings, validates risk and ownership, coordinates remediation with cloud and application teams, and maintains the quality of the platform’s policies, integrations, workflows, and reporting. It also delivers tested, incremental enhancements that help teams identify and address cloud security exposure. This role is suited to internal candidates with a security or technology foundation and an interest in developing cloud security skills.

Essential Functions

· Monitor CNAPP queues, dashboards, alerts, and platform health. Review new and aging findings, identify duplicates or data quality issues, and route actionable items to the appropriate cloud, platform, application, or security owner.

· Triage cloud misconfigurations, vulnerabilities, exposed assets, excessive permissions, and workload or container risks. Use asset context, exploitability, business criticality, and available threat information to validate severity and recommend an appropriate response.

· Investigate findings by reviewing cloud configurations, resource relationships, platform evidence, and available logs or metadata. Document the technical basis, affected resources, recommended remediation, and any applicable exception or compensating control.

· Coordinate remediation with engineering and service teams. Track progress against agreed service targets, follow up on overdue or recurring issues, validate fixes in the CNAPP platform, and escalate material or time-sensitive exposure through established processes.

· Administer and support CNAPP capabilities, including user and role access, cloud account and subscription onboarding, integrations, asset inventory, notification routes, policy configuration, and platform settings.

· Improve platform coverage and signal quality by tuning existing policies, adjusting thresholds, testing new or changed detections, and reviewing false positives, missed coverage, and recurring finding patterns with the relevant security and engineering partners.

· Build and test modest platform enhancements such as custom policies, dashboards, reports, API-based utilities, workflow changes, or integrations. Maintain clear change notes and supporting procedures, and follow the organization’s change and release practices.

· Prepare operational reporting on exposure trends, remediation status, platform coverage, finding quality, and service health. Explain notable changes and data limitations so teams can act on the results.

· Contribute to security risk assessments, cloud security reviews, incident investigations, and audit evidence requests involving CNAPP data or cloud attack surface exposure.

· Maintain runbooks and knowledge articles for recurring operational tasks. Share platform guidance with users and help improve support handoffs and repeatable triage practices.

Working Relationships

Partners with Cloud Engineering, Platform Engineering, DevOps, application teams, Security Operations, Security Architecture, and other technology groups to resolve exposure and maintain effective CNAPP operations. Communicates clearly with technical and business stakeholders and works with platform vendors when troubleshooting or evaluating product capabilities.

Knowledge and Skills

· Working knowledge of at least one major cloud platform, including its core services and terminology; experience across multiple cloud platforms is useful.

· Understanding of CNAPP capabilities and related areas such as cloud security posture management (CSPM), cloud workload protection (CWPP), cloud infrastructure entitlement management (CIEM), vulnerability management, and container security.

· Ability to interpret cloud assets, identities and permissions, network exposure, vulnerabilities, and configuration findings, then explain risk and remediation steps to engineering teams.

· Experience with security operations practices such as alert or finding triage, ticket ownership, prioritization, escalation, remediation tracking, and evidence-based closure.

· Ability to troubleshoot SaaS security platforms, integrations, data ingestion, policy behavior, access, and reporting issues in partnership with platform or cloud administrators.

· Basic scripting or API experience in a language such as Python, PowerShell, or Bash to support investigation, data checks, or small platform enhancements. Infrastructure as Code experience is useful but is not the primary focus of this role.

· Strong written and verbal communication, attention to detail, sound judgment when handling security findings, and the ability to manage multiple operational priorities.

Typical Education

Generally requires a bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent practical experience.

Typical Range of Experience

Typically requires 2–3 years of experience in information security, cloud security, security operations, cloud engineering, or a related technical role. Experience supporting a CNAPP or comparable cloud security platform is preferred.

Required Certification

Candidates must hold an introductory cloud or cloud security certification at the time of selection. Accepted certifications include AWS Certified Cloud Practitioner, Microsoft Certified: Azure Fundamentals, Google Cloud Digital Leader, or the Certificate of Cloud Security Knowledge (CCSK) from the Cloud Security Alliance. An equivalent foundational certification may be accepted with manager approval.

Pay Range: $97,700.00 - $130,300.00 Annually

This hiring range is a reasonable estimate of the base pay range for this position at the time of posting. Pay is based on a number of factors which may include job-related knowledge, skills, experience, business requirements and geographic location.

** Note that the following statements only apply to candidates who will be working from an unincorporated area within Los Angeles County. **

First American will consider for employment all qualified applicants, including those with arrest or conviction records, in a manner consistent with the requirements of applicable state and local laws (e.g., the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act).

First American intends to conduct a review of an applicant’s criminal history in connection with a conditional offer. First American reasonably believes that a criminal history may have a direct, adverse and negative relationship with the following material job duties for this position potentially resulting in the withdrawal of the conditional offer of employment: handling of confidential, proprietary or trade secret information belonging to First American or its customers, administrating or facilitating financial transactions, and the ability to meet customer-imposed criminal history requirements.

What We Offer

By choice, we don’t simply accept individuality – we embrace it, we support it, and we thrive on it! Our People First cultur