Cloud Security Engineer

Hydrogen Group; Sydney; On-site; AUD 120,000 - 180,000; Full time

Job summary

Hydrogen Group is seeking a hands-on Cloud Security Engineer to strengthen AWS platforms for our clients in Sydney.

You will fix high‑risk issues, implement guardrails, and collaborate with platform and application teams to ensure secure, repeatable deployments.

Qualifications

• AWS security and engineering knowledge across IAM, network security, encryption, and workload protection.
• Python scripting to automate fixes and verify controls.
• Hands-on with Git, CNAPP/CSPM tools, AWS Control Tower, SIEM integration, and vulnerability management.
• Experience building secure CI/CD pipelines for cloud infrastructure with GitHub Actions and deployment guardrails.
• CloudFormation experience (essential).
• Familiar with NIST, ISO 27001, ASD Essential Eight, and APRA CPS 234.

Responsibilities

• Fix cloud security issues directly, including vulnerabilities, misconfigurations, risky identity setups, and control gaps.
• Collaborate with cloud platform teams to roll out fixes and close findings.
• Automate recurring fixes and harden the delivery pipeline with secure templates and gates.
• Identify repeat findings and design stronger controls and guardrails.
• Support day-to-day security operations with telemetry, incident response, standards, playbooks and audits.
• Own the exemption process for cloud security risks, tracking approvals and expirations.

Skills

AWS security

IAM & network security

Secrets management

Python scripting

AWS APIs automation

Git

CNAPP/CSPM tools

AWS Control Tower

SIEM integration

CI/CD pipelines

CloudFormation

Compliance standards

Tools

GitHub Actions

CloudFormation

SIEM

CNAPP/CSPM tools

AWS Control Tower

Vulnerability management tools

Job description

We’re looking for a hands-on, Cloud Security Engineer to strengthen the security of our clients AWS platforms. You’ll work alongside platform and application teams, fixing the highest-risk issues first and shaping the guardrails that stop the same problems coming back.

What you’ll be doing

• Fixing cloud security issues directly, including vulnerabilities, misconfigurations, risky identity setups and control gaps raised through security tooling and the vulnerability management process
• Working with the cloud platform team and workload owners to roll out changes, then confirming each fix has been applied properly and the finding is genuinely closed
• Automating recurring fixes and control checks, and hardening the infrastructure delivery pipeline with secure pipeline templates, CloudFormation validation, secrets protection, approval steps and security gates
• Spotting patterns behind repeat findings, then designing stronger controls, guardrails and secure platform patterns, and writing up the requirements, the options and the risk reduction you expect
• Supporting day-to-day security operations through telemetry, incident response, standards, playbooks and audit
• Owning the exemption process for cloud security risks: assessing the remaining risk, recording the business reason and compensating controls, getting sign-off, and tracking each exemption until it is reviewed or expires

What you’ll bring

• Deep AWS security and engineering knowledge across identity and access management, network security, encryption, secrets management, logging and workload protection
• Python scripting skills, using AWS APIs to automate fixes and check that controls are working
• Hands-on experience with Git, CNAPP/CSPM tools, AWS Control Tower (or similar), SIEM integration and vulnerability management
• Experience building secure CI/CD pipelines for cloud infrastructure, including GitHub Actions or a comparable tool, automated testing, secrets handling, approval controls and deployment guardrails
• CloudFormation experience (essential)
• Working knowledge of NIST, ISO 27001, the ASD Essential Eight and APRA CPS 234

Nice to have

• Sceptre, GCP and Azure experience
• A relevant AWS security certification

Good luck!!