Company Overview

IDMe is the next-generation digital identity wallet that simplifies how individuals securely prove their identity online. Consumers can verify their identity with IDMe once and seamlessly login across websites without having to create a new login and verify their identity again. Over 175 million users experience streamlined login and identity verification with IDMe at 22 federal agencies, 50 state government agencies, and more than 100 healthcare organizations. Over 600 consumer brands use IDMe to verify communities and user segments to honor service and build more authentic relationships. IDMe’s technology meets the federal standards for consumer authentication set by the Commerce Department and is approved as a NIST 800-63-3 IAL2 / AAL2 credential service provider by the Kantara Initiative. IDMe is committed to “No Identity Left Behind” to enable all people to have a secure digital identity. To learn more, visit https://network.id.me/.

IDMe is a full-time, in-office culture. Unless a specific job description explicitly states otherwise, all roles are on-site five days per week at one of our offices in McLean, VA; Mountain View, CA; New York City, NY; or Tampa, FL. Certain roles — such as field-based sales or other remote-by-design positions — may have different work arrangements as noted in their individual postings.

At IDMe, we embrace the thoughtful use of AI tools in our daily work and there are even occasions where we leverage AI in our hiring process. However, during the interview process, we want to understand your individual skills and experiences. Therefore, we have guidelines on how AI can be appropriately used during your application and interviews which can be found here.

Role Overview:

IDMe is seeking a Staff Cloud Detection & Response Engineer to serve as our senior technical authority on threat detection and incident response across our cloud environments. This is a defender-first role, not an engineering or SRE role; when a high-severity cloud incident happens, you have the technical authority to lead it end to end. Your primary mission is detecting, investigating, and eliminating threats across our cloud infrastructure, Kubernetes workloads, and CI/CD surface.

You bring deep, hands-on fluency in AWS and/or GCP cloud security architecture, and you use it to make faster, more decisive calls during an incident and to advise engineering and platform teams on secure-by-design practices. You are a highly technical consultant to the teams who own the infrastructure; you influence how it's built through review, threat modeling, and architectural guidance, not by writing and owning the Terraform or CI/CD pipelines yourself. Your value is in detection depth, response authority, and the judgment to know exactly where an attacker would go next in a modern cloud environment.

Key Responsibilities

Lead high-severity cloud security incidents with full technical authority from initial detection through containment, eradication, and recovery across cloud infrastructure, Kubernetes (EKS/GKE), and CI/CD-deployed workloads.
Engineer immutable cloud forensics pipelines, including automated disk and memory snapshot capture at the moment of containment, so evidence from ephemeral compute and Kubernetes pods survives autoscaling and termination.
Advise engineering and platform teams on secure-by-design cloud architecture, IAM least-privilege structures, network security perimeters (e.g., AWS Organizations SCPs / VPC Service Controls), and workload identity, serving as a technical reviewer and consultant rather than the engineer implementing the change.
Drive visibility into CI/CD pipelines for security signals (such as dependency/SBOM findings, secret-scanning alerts, and admission-control violations) surfaced to your team for detection and response, rather than owning the pipeline configuration itself.
Conduct deep Kubernetes runtime security investigations, including cluster and node compromise, container escape scenarios, malicious admission-controller bypass, and workload identity abuse at the pod, node, and API-server level.