Brookfield
At a Glance
Location
US TN - RemoteBusiness - Real Estate
Brookfield Real Estate Group is one ofBrookfield’s primary operating groups. The Real Estate Group is one of the world's largest investors in real estate, with a global portfolio that includes office, retail, multifamily, logistics, hospitality and alternative real estate assets on five continents. The Group owns and operates approximately $268 billion of assets representing the most iconic properties in the world’s most dynamic markets. We seek to generate value by leveraging our operating expertise and focusing on our core real estate capabilities of leasing, financing, development, design and construction as well as property and facilities management. For more information, visit https://www.brookfield.com/our-businesses/real-estate.
Brookfield Culture
Brookfield has a unique and dynamic culture. We seek team members who have a long-term focus and whose values align with our Attributes of a Brookfield Leader: Entrepreneurial, Collaborative and Disciplined. Brookfield is committed to the development of our people through challenging work assignments and exposure to diverse businesses.
Job Description
The Staff Security Engineer, Cloud & AI Platform is a deeply technical, hands-on role responsible for making Brookfield Real Estate’s cloud and AI platforms secure by design. You will lead security architecture and implementation across AWS, Infrastructure as Code, software delivery, internally developed applications, and AI/agent systems.
This is a builder role. You will threat-model a design, review the underlying Terraform and application code, implement the control, instrument it, and help teams adopt it without unnecessary friction. Security requirements become reusable modules, automated checks, secure defaults, and clear engineering guidance rather than documents and findings lists.
You will partner closely with Cloud Solutions, application engineering, AI engineering, Identity, CyberOps, and GRC/Privacy. Platform engineering continues to own general platform uptime, capacity, and deployment mechanics, and CyberOps continues to own alert triage; this role owns the architecture, controls, tooling, and assurance mechanisms that make those systems safe.
Leadership & Security Architecture
Help define security architecture for the cloud and AI platforms: set direction, write specs, and steward secure-by-default patterns across teams
Define security engineering standards and paved roads, document important decisions, and communicate risk and trade-offs to engineering and business leadership
Review infrastructure and application designs for authorization, network, data-protection, secrets, and tenant-isolation risks
Mentor engineers and raise the organization’s ability to make sound security decisions independently
Partner with Cloud Solutions, application engineering, AI engineering, Identity, CyberOps, and GRC/Privacy to prioritize work and drive adoption
Cloud & Identity Security
Own and evolve security architecture for a multi-account AWS organization — account boundaries, service control policies, IAM Identity Center, delegated security services, KMS, VPC controls, and WAF
Design least-privilege human and workload access across AWS, Okta, GitHub Actions, and Infrastructure as Code platforms using federation and short-lived credentials
Build and maintain reusable security controls in Terraform or OpenTofu, with safe rollout, testing, monitoring, and recovery patterns
Strengthen centralized logging and evidence — CloudTrail, Config, GuardDuty, Security Hub, Macie, and CloudWatch — and keep guardrails current as the environment grows
Secure Software Delivery
Establish secure GitHub Actions and runner patterns, including OIDC trust, environment separation, workflow protection, action pinning, artifact integrity, and least-privilege deployment roles
Integrate practical security checks into developer workflows — secrets detection, dependency and container scanning, SBOMs, Infrastructure as Code analysis, code scanning, and risk-based release gates
Support vulnerability management for internally developed software, from detection and prioritization through remediation evidence and exception handling. Partner with the Vulnerability Manager to establish prioritization and reduce false positives
Improve controls with engineers rather than around them, avoiding noisy or easily bypassed gates
Application & AI Security
Lead threat modeling and security design reviews for web applications, APIs, data ingestion, authentication and authorization flows, and agentic systems
Define secure patterns for Amazon Bedrock and other model platforms, including model access, guardrail lifecycle, invocation logging, usage attribution, and sensitive-data controls
Harden agent tools, MCP servers, gateways, sandboxes, and code-execution environments against prompt injection, confused-deputy attacks, excessive agency, secret disclosure, data exfiltration, and cross-tenant access
Build repeatable security evaluations and adversarial tests for AI-enabled features and connect findings to engineering remediation
Detection, Response & Assurance
Translate cloud and application telemetry into actionable detections, runbooks, ownership, and escalation paths in partnership with CyberOps
Lead technical response and root-cause remediation for cloud, identity, software supply chain, and AI security incidents
Establish severity and ownership standards for cloud findings, software vulnerabilities, and AI security issues, with clear remediation expectations
Produce the control evidence GRC and Privacy need, without turning engineering work into manual reporting
8+ years Experience
Demonstrated senior or Staff-level ownership of production security or platform systems, including architecture decisions others build on
Deep AWS security experience across IAM, multi-account or AWS Organizations environments, logging and detection, KMS, networking, and service-to-service authorization
Strong Terraform or OpenTofu skills, including modular design, remote execution, policy controls, and safe state-aware changes
Experience securing CI/CD systems such as GitHub Actions, including OIDC federation, runner trust boundaries, secrets, artifacts, and deployment permissions
Working knowledge of application security fundamentals: threat modeling, authentication and authorization, secure API design, secrets handling, dependency risk, and vulnerability remediation
Ability to read and write production-quality automation or application code in Python, Go, Ruby, or a comparable language
Demonstrated ability to influence teams you do not manage, make pragmatic risk decisions, and turn ambiguous security needs into implemented controls
Nice to Have
Experience with Amazon Bedrock, AgentCore, MCP, LLM gateways, AI guardrails, or production agentic systems
Container and orchestration security — ECS/Fargate or EKS, image supply chains, runtime isolation, and egress control
Identity platform depth: IAM Identity Center, Okta, Delinea, SAML, OIDC, OAuth, SCIM, ABAC, and enterprise entitlement systems
Experience with Scalr, Terraform Cloud, or another remote Infrastructure as Code platform
Familiarity with CrowdStrike Falcon Cloud Security, Datadog, CloudWatch, or comparable security and observability tooling
Data platform and sensitive-data controls involving S3, Snowflake, PostgreSQL/Aurora, or vendor data ingestion
AI threat modeling, red teaming, or security evaluation experience
At Brookfield, your career progression is important to us. As a successful employee, you will have the opportunity to grow within your team, department, and across the Brookfield organization. Our leadership teams are dedicated to the accomplishments of their employees. We also invest time into training and developing our people.
End your job search and find your career today, at Brookfield.
We imagine, create, and operate on a foundation of values to build a better world, together. Brookfield strives to create spaces where going to work never feels routine. As a Brookfield employee, you will enjoy many benefits such as 401K matching, tuition reimbursement, summer Fridays, paid maternity leave and more. There is also a generous employee referral program because we want our existing team members to help us build a more diverse workplace through their networks.
Our compensation structure is comprised of a base salary and a short-term incentive program (cash bonus). Cash compensation tends to vary based on geography to account for local market conditions and is set to be market competitive. Compensation decisions are based on a number of factors including relative experience, overall years of experience, industry experience, education and designations.
Brookfield is committed to maintaining a Positive Work Environment that is safe and respectful; our shared success depends on it. We do not tolerate workplace discrimination, violence or harassment. We are proud to be an Equal Opportunity Employer and make employment decisions based on qualifications, merit and business needs, without regard to any characteristic protected by applicable law. Applicant information is collected and handled in accordance with our Applicant Privacy Notice.
Source: Brookfield careers · View original posting
Brookfield Corporation is a Canadian multinational alternative investment management firm, recognized as one of the largest in the world, managing over US$1 trillion in assets. The company focuses on building long-term wealth for both institutions and individuals globally. Founded in 1899 and restructured through a merger in 1997, Brookfield is headquartered in Toronto, Ontario, with its operational headquarters moving to New York City in 2024. The firm operates through three main areas: Asset Management, Wealth Solutions, and Operating Businesses. Its Asset Management division offers private funds and credit strategies, focusing on sectors like real estate, renewable power, and infrastructure. Wealth Solutions provides insurance and retirement services, while Operating Businesses manage significant interests in real assets across more than 30 countries. Brookfield serves a diverse client base, including institutional investors and individual investors, and typically invests its own capital alongside clients to align interests.
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
Security Philosophy
“Mission and priorities: The current role is responsible for “making Brookfield Real Estate’s cloud and AI platforms secure by design.” – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Developer enablement versus gatekeeping: The role states that security requirements should become “reusable modules, automated checks, secure defaults, and clear engineering guidance.” It also requires teams to adopt controls “without unnecessary friction” and says to “improve controls with engineers rather than around them.” – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Risk philosophy: The posting requires “risk-based release gates” and prioritization of vulnerabilities with the Vulnerability Manager to “reduce false positives.” – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Stated goals and pain points: The role calls for “security standards and paved roads,” risk-and-trade-off communication, vulnerability prioritization, remediation evidence, exception handling, and reduction of false positives. – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Enterprise risk posture: Brookfield Asset Management states that its cybersecurity program addresses “vulnerability management, penetration testing, security monitoring and incident response” and aligns with the NIST Cybersecurity Framework. – Brookfield Asset Management 2025 Form 10-K (PDF), Regulatory Filing, Gaps and contradictions: No public leader interview or AppSec-specific mission statement was found beyond the job description and enterprise cybersecurity disclosures”
Security Team
Key Initiatives
Security-by-design and secure engineering: The current role requires security architecture across AWS, IaC, software delivery, internally developed applications, and AI/agent systems. – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Shift-left in practice: Developer workflows are to include “secrets detection, dependency and container scanning, SBOMs, Infrastructure as Code analysis, code scanning, and risk-based release gates.” – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Threat modeling and secure SDLC artifacts: The role includes threat modeling and security design reviews for “web applications, APIs, data ingestion, authentication and authorization flows, and agentic systems.” – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Vulnerability-management intake and remediation: The posting states that the role supports vulnerability management “from detection and prioritization through remediation evidence and exception handling” and partners with the Vulnerability Manager to reduce false positives. – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Ownership and escalation: The role establishes “severity and ownership standards” for cloud findings, software vulnerabilities, and AI security issues, with clear remediation expectations. – Staff Security Engineer job post (Job ID R2052488-2), Company Source, Enterprise vulnerability-management process: Brookfield’s 2025 disclosure records annual technology-risk assessments for critical systems and applications, monthly vulnerability scans, external or internal assessments, and risk assessment for identified violations. – Brookfield Private Equity Fund cybersecurity disclosure, Regulatory Disclosure, Recent initiatives: Brookfield Asset Management reported completing a global SASE transition with enhanced zero-trust security, enhancing vulnerability management and attack-surface reduction, implementing ransomware-protected backups, and continuing mandatory cybersecurity education and phishing simulations in 2025. – Brookfield Asset Management 2025 Form 10-K (PDF), Regulatory Filing, Gaps and contradictions: Public disclosures describe enterprise cybersecurity and a Real Estate cloud/AI security role, but do not document a separately named enterprise AppSec team, security-champions program, or vendor-specific AppSec tooling
Preparing for an AppSec interview?
Get the weekly briefing 2,000+ security pros trust.
Interested in this role?
Apply on Brookfield's site