Sr InfoSec Engineer

HMH is a learning technology company committed to delivering connected solutions that engage learners, empower educators and improve student outcomes. As a leading provider of K–12 core curriculum, supplemental and intervention solutions, and professional learning services, HMH partners with educators and school districts to uncover solutions that unlock students’ potential and extend teachers’ capabilities. HMH serves more than 50 million students and 4 million educators in 150 countries. For more information, visit Join our Information Security team as a Senior Cloud Security Engineer, where you will play a key role in protecting and enhancing our multi-cloud environment to strengthen the organization's overall security posture. This position offers the opportunity to lead cloud security engineering responsible for monitoring cloud security posture, identifying and responding to security threats and vulnerabilities, and ensuring the protection of cloud-based applications, systems, and data and automation initiatives across our hybrid cloud infrastructures (AWS, Azure). You will partner closely with Engineering, IT, DevOps, Architecture, Product, Risk, and Compliance teams to strengthen cloud security posture, drive remediation efforts, improve security controls, and support compliance objectives. The ideal candidate is a hands-on security professional with expertise in Cloud security, DevSecOps, automation, security monitoring, and security alerts related responses who thrives in a collaborative, fast-paced environment and is passionate about securing critical business systems and data. This position offers the opportunity to influence security strategy, leverage modern security technologies, automation, AI Initiatives and cloud-native capabilities to protect critical business systems, applications, and data while enabling innovation across the organization. Why Join Us At HMH, we are building a security-first culture that embraces innovation, collaboration, and continuous learning. You will have the opportunity to work with modern cloud technologies, drive meaningful security improvements, and partner with talented teams across the enterprise. We foster an environment where curiosity is encouraged, professional growth is supported, and individuals are empowered to make a measurable impact on the security and success of the organization. If you are passionate about cloud security, security engineering, AI based automation, and help organizations securely scale in the cloud, we encourage you to join us on our digital transformation journey. Duties & Responsibilities include: Proven hands-on experience in AWS and comparable cloud infrastructures, including the design, implementation, operation, and continuous improvement of enterprise-scale security architectures, controls, and services across multi-cloud and hybrid environments. Strong knowledge and practical experience working with cloud security constructs (SG, VPC, NACL etc.) and services IAM, ECC2, S3, KMS etc.) across AWS, Azure Work autonomously and effectively to meet deadlines. Develop and enforce cloud security policies, standards, and guidelines. Maintain secure system baselines and harden standards for infrastructure, cloud, and container environments to support vulnerability management and security operations objectives. Configure and maintain Identity and Access Management (IAM) policies, roles, and permissions for least privilege access. Administer and monitor enterprise encryption and key management controls to safeguard sensitive data throughout its lifecycle. Monitor cloud security posture, vulnerabilities, security events, alerts, and misconfigurations using SIEM, CSPM, CWPP, and other security operations technologies, and collaborate with infrastructure, engineering, and application teams to drive timely risk remediation and continuous security improvements. Knowledge of regulatory and industry security frameworks such as ISO 27001, NIST, GDPR, HIPAA, SOC 2, and PCI DSS, and experience supporting compliance initiatives, control monitoring, risk assessments, and remediation activities within cloud environments. Monitor cloud security metrics, dashboards, and performance indicators to assess security effectiveness, track vulnerabilities and alerts, and ensure timely remediation and incident response in collaboration with technology teams. Work closely with the Product and Architecture teams to review designs and ensure robust cloud security. Hands-on experience with Python, Terraform, Java, PowerShell, and Bash for security automation, workflow optimization, and vulnerability management. Plan, implement, and track key initiatives to strengthen application security across all stages of the software development lifecycle (SDLC). Advocate within the organization to ensure the security of data, systems, applications, and networks, adhering to security best practices. Qualifications Bachelor’s degree in computer science, Information Security, Engineering, or a related field. 5+ years of experience in DevSecOps, Cloud Security, Security Engineering, or related disciplines. Strong hands-on experience with cloud platforms such as AWS and Azure. Strong communication skills (both oral and written), along with excellent interpersonal, organizational, and presentation abilities. Capable of translating complex data into executive-level graphical reports and dashboards. Experience working in a collaborative, agile development environment and effectively contributing as a team player is a must Experience integrating security controls into CI/CD pipelines and DevOps workflows. Strong understanding and familiarity with Kubernetes and microservice architecture is needed. Proficiency in scripting and automation using Python, Terraform, PowerShell, Bash, or similar technologies. Prior experience in Design, develop, and debug secure software for externally facing corporate web sites within Web Content Management framework is nice to have. Experience with Infrastructure as Code (IaC), container technologies (Docker, Kubernetes), and cloud-native security controls. Knowledge of vulnerability management, SIEM, CSPM, CWPP, and security monitoring tools. Understanding of secure software development practices, application security testing, and threat modeling. Familiarity with compliance and security frameworks such as NIST, ISO 27001, SOC 2, PCI DSS, GDPR, and HIPAA. Strong problem-solving, communication, and cross-functional collaboration skills. Relevant certifications preferred (e.g., AWS Security Specialty, Azure Security Engineer, CISSP, CCSP, CKS, Security+). The Information Technology organization is transforming to realize our mission: Become a leader in HMH’s digital transformation, and as a strategic partner, innovate and deliver highest value, competitive advantage solutions across all corporate and business functions. Our ambition is to be a digital leader through innovation and develop and deliver leading edge technology such as robotic process automation and artificial intelligence to solve some of HMH’s greatest operational business challenges. Our professionals will have business relevant skills to connect our HMH partners to technologies that propel the businesses to deliver the greatest value for HMH and our customers. We are building a team of IT professionals with an insatiable appetite to learn, a relentless focus on customer service, a technological curiosity toward future possibilities, and a creativity in solving business challenges with leading technologies. Our team will find ways to work together, create a sense of community where it’s safe to take risks and learn together, develop our careers, and all have an opportunity to work on new technologies. We will work together, learn together and have fun together. As a team, we will lead HMH’s digital transformation.