Staff Security Engineer, Cloud & AI Platform

Location

US TN - Remote

Business - Real Estate

Brookfield Real Estate Group is one of Brookfield’s primary operating groups. The Real Estate Group is one of the world's largest investors in real estate, with a global portfolio that includes office, retail, multifamily, logistics, hospitality and alternative real estate assets on five continents. The Group owns and operates approximately $268 billion of assets representing the most iconic properties in the world’s most dynamic markets. We seek to generate value by leveraging our operating expertise and focusing on our core real estate capabilities of leasing, financing, development, design and construction as well as property and facilities management. For more information, visit https://www.brookfield.com/our-businesses/real-estate .

Brookfield Culture

Brookfield has a unique and dynamic culture. We seek team members who have a long-term focus and whose values align with our Attributes of a Brookfield Leader: Entrepreneurial, Collaborative and Disciplined. Brookfield is committed to the development of our people through challenging work assignments and exposure to diverse businesses.

Job Description

The Staff Security Engineer, Cloud & AI Platform is a deeply technical, hands-on role responsible for making Brookfield Real Estate’s cloud and AI platforms secure by design. You will lead security architecture and implementation across AWS, Infrastructure as Code, software delivery, internally developed applications, and AI/agent systems.

This is a builder role. You will threat-model a design, review the underlying Terraform and application code, implement the control, instrument it, and help teams adopt it without unnecessary friction. Security requirements become reusable modules, automated checks, secure defaults, and clear engineering guidance rather than documents and findings lists.

You will partner closely with Cloud Solutions, application engineering, AI engineering, Identity, CyberOps, and GRC/Privacy. Platform engineering continues to own general platform uptime, capacity, and deployment mechanics, and CyberOps continues to own alert triage; this role owns the architecture, controls, tooling, and assurance mechanisms that make those systems safe.

Role & Responsibilities:

Leadership & Security Architecture

Help define security architecture for the cloud and AI platforms: set direction, write specs, and steward secure-by-default patterns across teams

Define security engineering standards and paved roads, document important decisions, and communicate risk and trade-offs to engineering and business leadership

Review infrastructure and application designs for authorization, network, data-protection, secrets, and tenant-isolation risks

Mentor engineers and raise the organization’s ability to make sound security decisions independently

Partner with Cloud Solutions, application engineering, AI engineering, Identity, CyberOps, and GRC/Privacy to prioritize work and drive adoption

Cloud & Identity Security

Own and evolve security architecture for a multi-account AWS organization — account boundaries, service control policies, IAM Identity Center, delegated security services, KMS, VPC controls, and WAF

Design least-privilege human and workload access across AWS, Okta, GitHub Actions, and Infrastructure as Code platforms using federation and short-lived credentials

Build and maintain reusable security controls in Terraform or OpenTofu, with safe rollout, testing, monitoring, and recovery patterns

Strengthen centralized logging and evidence — CloudTrail, Config, GuardDuty, Security Hub, Macie, and CloudWatch — and keep guardrails current as the environment grows

Secure Software Delivery

Establish secure GitHub Actions and runner patterns, including OIDC trust, environment separation, workflow protection, action pinning, artifact integrity, and least-privilege deployment roles

Integrate practical security checks into developer workflows — secrets detection, dependency and container scanning, SBOMs, Infrastructure as Code analysis, code scanning, and risk-based release gates

Support vulnerability management for internally developed software, from detection and prioritization through remediation evidence and exception handling. Partner with the Vulnerability Manager to establish prioritization and reduce false positives

Improve controls with engineers rather than around them, avoiding noisy or easily bypassed gates

Application & AI Security

Lead threat modeling and security design reviews for web applications, APIs, data ingestion, authentication and authorization flows, and agentic systems

Define secure patterns for Amazon Bedrock and other model platforms, including model access, guardrail lifecycle, invocation logging, usage attribution, and sensitive-data controls

Harden agent tools, MCP servers, gateways, sandboxes, and code-execution environments against prompt injection, confused-deputy attacks, excessive agency, secret disclosure, data exfiltration, and cross-tenant access

Build repeatable security evaluations and adversarial tests for AI-enabled features and connect findings to engineering remediation

Detection, Response & Assurance

Translate cloud and application telemetry into actionable detections, runbooks, ownership, and escalation paths in partnership with CyberOps

Lead technical response and root-cause remediation for cloud, identity, software supply chain, and AI security incidents

Establish severity and ownership standards for cloud findings, software vulnerabilities, and AI security issues, with clear remediation expectations

Produce the control evidence GRC and Privacy need, without turning engineering work into manual reporting

Your Qualifications:

8+ years Experience

Demonstrated senior or Staff-level ownership of production security or platform systems, including architecture decisions others build on

Deep AWS security experience across IAM, multi-account or AWS Organizations environments, logging and detection, KMS, networking, and service-to-service authorization

Strong Terraform or OpenTofu skills, including modular design, remote execution, policy controls, and safe state-aware changes

Experience securing CI/CD systems such as GitHub Actions, including OIDC federation, runner trust boundaries, secrets, artifacts, and deployment permissions

Working knowledge of application security fundamentals: threat modeling, authentication and authorization, secure API design, secrets handling, dependency risk, and vulnerability remediation

Ability to read and write production-quality automation or application code in Python, Go, Ruby, or a comparable language

Demonstrated ability to influence teams you do not manage, make pragmatic risk decisions, and turn ambiguous security needs into implemented controls

Nice to Have

Experience with Amazon Bedrock, AgentCore, MCP, LLM gateways, AI guardrails, or production agentic systems

Container and orchestration security — ECS/Fargate or EKS, image supply chains, runtime isolation, and egress control

Identity platform depth: IAM Identity Center, Okta, Delinea, SAML, OIDC, OAuth, SCIM, ABAC, and enterprise entitlement systems

Experience with Scalr, Terraform Cloud, or another remote Infrastructure as Code platform

Familiarity with CrowdStrike Falcon Cloud Security, Datadog, CloudWatch, or comparable security and observability tooling

Data platform and sensitive-data controls involving S3, Snowflake, PostgreSQL/Aurora, or vendor data ingestion

AI threat modeling, red teaming, or security evaluation experience

Your Career @ Brookfield:

At Brookfield, your career progression is important to us. As a successful employee, you will have the opportunity to grow within your team, department, and across the Brookfield organization. Our leadership teams are dedicated to the accomplishments of their employees. We also invest time into