Lead Engineer – Cloud Security (Security Governance)

The pay range is $132,000.00 - $238,000.00 Pay is based on several factors which vary based on position. These include labor markets and in some instances may include education, work experience and certifications. In addition to your pay, Target cares about and invests in you as a team member, so that you can take care of yourself and your family. Target offers eligible team members and their dependents comprehensive health benefits and programs, which may include medical, vision, dental, life insurance and more, to help you and your family take care of your whole selves. Other benefits for eligible team members include 401(k), employee discount, short term disability, long term disability, paid sick leave, paid national holidays, and paid vacation. Find competitive benefits from financial and education to well-being and beyond at https://corporate.target.com/careers/benefits.

Working at Target means helping all families discover the joy of everyday life. We bring that vision to life through our values and culture. Learn more about Target here. Target is one of the world's most recognized brands and one of America's leading retailers. But behind the brand our guests love, is a culture of continual innovation and right now, we are up to big things! Target's security team is a place where innovation happens daily. Interested in a culture that combines ongoing learning, engineering excellence, and stellar outcomes? We are too – that's why we work here. Join our team to improve Target's security and move the business forward.

As a Lead Engineer on the Cloud Security team, you'll be the senior technical owner of the engineering workflows and services that make cloud security governance practical at Target scale. You'll help teams understand security requirements, onboard to Cloud Security capabilities, adopt usable controls, and move findings and exception requests through clear, evidence-based processes. You'll build the automation and operational mechanisms that connect security intent with accountable decisions and action.

Beyond deep technical expertise, you have a strong bias for action and a builder's mindset. Cloud security governance sits between security requirements, the capabilities that enforce them, and the product and platform teams who need to use them. You are comfortable operating in that realm – translating approved requirements into clear workflows, engineering reliable onboarding and exception-management capabilities, improving adoption through evidence and feedback, and partnering with decision owners so risks are reviewed and handled consistently. You have the engineering credibility to set technical direction for other engineers as a hands-on IC, and the communication and partnership skills to make governance work well across Target.

Expect to:

• Serve as the senior technical lead and hands-on owner of Cloud Security governance engineering - setting technical direction, standards, and a roadmap for the workflows, integrations, and automation that other engineers and partners use.
• Design, build, and operate a consistent lifecycle for cloud security exceptions: intake, completeness checks, control and asset context, risk and impact information, compensating controls, accountable decision owner, review date, expiry or renewal, and closure evidence.
• Make exception requests traceable and decision-ready. Route them to the appropriate policy, architecture, business, or risk-acceptance authority; track decisions and conditions; and escalate overdue or incomplete requests through agreed paths. This role enables and records decisions but does not independently approve policy deviations or accept risk.
• Engineer workflows that connect security findings, control requirements, exceptions, remediation ownership, service-level expectations, and closure evidence to the agreed enterprise governance and remediation systems.
• Lead onboarding and adoption of Cloud Security capabilities across eligible cloud accounts, projects, workloads, and engineering teams. Partner with platform and software engineers to define practical entry criteria, steps, ownership, enablement materials, support paths, and feedback loops.
• Treat onboarding and governance as products: reduce friction and one-off coordination through clear guidance, self-service, automation, reusable patterns, and well-defined service interfaces.
• Work with Security Architecture and domain owners to translate approved standards, control requirements, and policy changes into understandable guidance, implementation handoffs, evidence expectations, and governance workflows. Security Architecture and designated authorities retain policy and formal risk decisions.
• Establish transparent reporting for adoption, coverage, exception quality and age, review and expiry status, finding ownership, remediation progress, and workflow health. Agree populations, definitions, owners, and baselines before proposing targets; distinguish security outcomes from process and service-health measures.
• Improve the quality and usability of governance data by partnering with Cloud Security platform and software engineers, ITDP, service owners, and enterprise workflow owners on asset attribution, ownership, severity, business context, and status feedback.
• Build integrations and automation for intake, routing, notifications, evidence capture, status synchronization, and reporting. Use existing enterprise capabilities where they meet the need; make pragmatic build-vs-buy recommendations where they do not.
• Operate governance services as production capabilities: own availability, performance, observability, capacity, change and release practices, failure handling, and on-call participation as appropriate. Establish service objectives for workflow reliability, completeness, and timeliness with stakeholders.
• Partner closely with the Cloud Security platform and software engineers so policy enforcement, findings, onboarding, exceptions, and remediation operate as a coherent end-to-end experience for engineering teams.
• Partner with Security Architecture, BISO/governance, Identity, Network, Data Protection, SecOps/Detection & Response, Vulnerability Management, ITDP, and product, platform, and service owners to clarify responsibilities, decision paths, service interfaces, and operational handoffs.
• Support audit, assurance, and leadership reviews by making approved control requirements, exception decisions, evidence, ownership, and remediation status discoverable and reliable. Do not represent working proposals, incomplete evidence, or candidate measures as approved policy or established compliance.
• Drive multi-quarter initiatives end-to-end: from problem framing and scoping, through design, build, rollout, adoption, and steady-state operation.
• Represent governance capability clearly to senior leadership and staff engineers alike: risk themes, adoption barriers, exception trends, decision needs, workflow health, and tradeoffs - in language tuned to the audience.
• Mentor other engineers on the team on security governance engineering, workflow automation, control evidence, and operational practices, and raise the bar for code quality, testing, code review, on-call hygiene, postmortems, and operational excellence.
• Continuously reduce toil for both the Cloud Security team and Target's engineering organization - fewer unclear requests, repeated approvals, manual status chases, and one-off onboarding paths; more consistent decisions, self-service, and timely feedback.

Core responsibilities are described within this job description. Job duties may change at any time due to business needs.

About You:

• 4-year degree OR equivalent work experience
• 7+ years of hands-on experience in technology, security engineering, platform engineering, or a related discipline, including experience building or operating capabilities in a large, complex organization
• Demonstrated experience as a senior IC or tech lead owning a technical capability end-to-end at enterprise scale, including setting technical direction that other engineers execute against
• Experience designing and improving security, risk, compliance, exception, or remediation workflows, with clear ownership, decision paths, evidence, review periods, and closure
• Strong understanding of security governance: how requirements, controls, evidence, exceptions, risk decisions, remediation, and assurance fit together to help an organization manage risk consistently
• Experience building, integrating, or automating workflow-oriented services, APIs, data flows, or platforms; fluency in at least one general-purpose programming language and willingness to work hands-on in the team's technology stack
• Track record of turning complex requirements into clear processes, usable technical workflows, operational guidance, and measurable outcomes without confusing process completion with risk reduction
• Experience driving adoption of security or platform capabilities across multiple engineering teams, including onboarding, enablement, support models, feedback, and continuous improvement
• Strong judgment in exception handling: able to gather context, identify missing information and potential compensating controls, explain tradeoffs, and route decisions to the authorized owner without treating an exception as automatically approved
• Experience defining operational measures and reporting for workflow quality, adoption, control coverage, remediation, or service health; able to establish trusted definitions and baselines before recommending targets
• Experience working with enterprise ticketing, governance, risk, compliance, asset, or security platforms and integrating systems through APIs, event streams, or data pipelines
• Hands-on experience with public cloud (GCP preferred; AWS/Azure experience also valued) and familiarity with cloud security controls, findings, and engineering workflows
• Working knowledge of security frameworks and standards (e.g., NIST, CIS Benchmarks, ISO/IEC 27001, or CSA CCM) and experience mapping requirements to controls and evidence; able to partner with Security Architecture and control owners rather than acting as the policy authority
• Track record of operating production services or business-critical workflows with observability, service objectives, change management, failure handling, and continuous-improvement practices
• Comfortable making and defending pragmatic build-vs-buy decisions and knowing when to automate, use an existing enterprise capability, or improve the operating model
• Strong cross-functional partner: comfortable working closely with security, risk, product, platform, infrastructure, and service teams to align requirements, adoption plans, decisions, and operational ownership
• Effective at representing your work, risks, and tradeoffs to senior leadership, and equally effective explaining the same content to staff engineers in detail
• Excellent written and verbal communication skills with strong presentation abilities; able to make security expectations and decision requests clear to both technical and non-technical audiences
• Demonstrated curiosity, bias for action, and a genuine builder's mindset - you want to improve and operate the capability, not just describe the process

Preferred Qualifications:

• Experience in cloud security, cybersecurity, security governance, GRC, or another risk-sensitive technology environment
• Experience with cloud security posture management (CSPM/CNAPP), infrastructure-as-code scanning, Kubernetes admission controls, software supply chain controls, or related security capabilities
• Experience designing exception workflows, policy lifecycle processes, control evidence models, or security finding-to-remediation programs
• Experience with workflow automation, service management, governance/risk/compliance platforms, and enterprise reporting or analytics
• Familiarity with cloud platforms and developer workflows, including source control, CI/CD, ticketing, and internal developer platforms
• Experience with policy-as-code, infrastructure as code, data quality, or security control testing

This position will operate as a Hybrid/Flex for Your Day work arrangement based on Target's needs. A Hybrid/Flex for Your Day work arrangement means the team member's core role will need to be performed both onsite at the Target HQ MN location the role is assigned to and virtually, depending upon what your role, team, and tasks require for that day. Work duties cannot be performed outside of the country of the primary work location, unless otherwise prescribed by Target. Click here if you are curious to learn more about Minnesota.

Benefits Eligibility Please paste this url into your preferred browser to learn about benefits eligibility for this role: https://tgt.biz/BenefitsForYou_E

Americans with Disabilities Act (ADA)

In compliance with state and federal laws, Target will make reasonable accommodations for applicants with disabilities. If a reasonable accommodation is needed to participate in the job application or interview process, please reach out to candidate.accommodations@HRHelp.Target.com. Non-accommodation-related requests, such as application follow-ups or technical issues, will not be addressed through this channel.