AWS Cloud Security Architect

InvestCloud, Inc.; United States; On-site; USD 175,000 - 200,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Disability insurance

Life insurance

AD&D insurance

HSA/FSA benefits

401(k) with company match

Paid time off

Job summary

InvestCloud is seeking a Cloud Security Architect with deep AWS security experience to design and build the AWS environment for our SaaS platform. You will own security across identity, networks, containers, storage, encryption, and logging, partnering with developers and infrastructure engineers.

Responsibilities include designing security baselines, logging, guardrails, and collaboration with our security stack, including Wiz, to fix cloud risk from code to runtime.

Qualifications

• Minimum eight years in security engineering or architecture, with five+ years hands-on AWS security in multi-account environments.
• Proven expertise in AWS identity, networking, encryption, and container security.

Responsibilities

• Design the security architecture for our AWS environment and collaborate with development teams.
• Set secure baselines for IAM, networking, containers, storage, encryption, and key management.
• Design security logging and monitoring across all AWS accounts and workloads.
• Review cloud designs and changes and provide practical guidance to keep projects moving.
• Build guardrails and automated checks to prevent insecure configurations in production.
• Collaborate with Application Security Architect to use Wiz for cloud risk fixing from code to runtime.
• Write reference architectures and patterns enabling secure build processes.
• Mentor engineers across the company.

Skills

AWS security

Multi-account security

Identity and access management

Container security

Logging and monitoring

Clear risk communication

Education

Bachelor's degree in CS or related field

AWS certifications (preferred)

Tools

Terraform

CloudFormation

Wiz

AWS IAM Identity Center

KMS / CloudHSM

CloudTrail / GuardDuty / Security Hub

Job description

We are looking for a Cloud Security Architect who knows Amazon Web Services (AWS) security inside and out and wants to build, not just advise.

You will design and help build the AWS environment that runs our software-as-a-service (SaaS) platform, working shoulder to shoulder with our developers and infrastructure engineers. You will own the security of every layer: identity, networks, containers, storage, encryption, and logging.

The banks and wealth managers who use our platform trust us with their clients' financial lives, and your work is a big part of why they can.

What You Will Do

• Design the security architecture for our AWS environment and take part in every stage of design and build alongside our development and infrastructure teams.
• Set and maintain secure baselines for identity and access, network and firewall controls, containers and Kubernetes, storage, encryption, key management, and cryptography.
• Design security logging and monitoring so we can see and investigate activity across every AWS account and workload.
• Review cloud designs and changes and provide clear, practical answers that keep projects moving.
• Build guardrails and automated checks that stop insecure configurations before they reach production.
• Partner with our Application Security Architect to use Wiz to find and fix cloud risk, from code to runtime.
• Write the reference architectures and patterns that let teams build securely without waiting on security.
• Mentor engineers across the company.

What Success Looks Like In Your First Year

• Every new service we run in AWS is secure from day one, not fixed later.
• Developers and infrastructure engineers bring you into their designs early because your involvement makes their work faster and better.
• Our AWS environment runs to a written secure standard, and anything that drifts from it is caught and corrected quickly.
• We can prove to customers, auditors, and regulators that our platform runs on secure infrastructure.

What You Bring

• TTypically eight or more years of experience in security engineering or architecture, with at least five focused on hands‑on AWS security in multi‑account environments.
• Expert knowledge of AWS identity, including IAM, AWS Organizations, service control policies, and IAM Identity Center.
• Expert knowledge of AWS networking, including VPC design, security groups, AWS Network Firewall, and AWS WAF.
• Expert knowledge of encryption, including KMS, CloudHSM, and certificate management.
• Strong container security experience with Amazon EKS or ECS, including image security, runtime protection, and least‑privilege workload identity.
• Experience designing security logging with CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and a central log platform.
• A working command of cryptography, including choosing the right algorithms, rotating keys, and protecting secrets.
• Infrastructure as code skills in Terraform or CloudFormation, along with the ability to read and write code.
• Experience securing a SaaS platform for regulated customers, ideally in financial services.
• The ability to explain complex risk in plain language to engineers and executives alike.

Bonus points

• Microsoft Azure or Microsoft 365 security experience.
• Hands‑on experience with Wiz or a similar cloud security platform.
• AWS Certified Security Specialty certification, or equivalent depth of experience.

Who You Are

• You hold yourself to a world‑class standard, and it shows in everything you deliver.
• You are a self‑starter. You find the work that matters and finish it without being asked.
• You care about this field beyond the job description. You keep learning and building on your own because you enjoy it, and you put in the extra effort when the mission calls for it.
• You bring drive, ambition, and a positive attitude to hard problems.
• You make the people around you better. You share what you know, you never make anyone feel small, and you let your work speak for itself.

How We Work

Our security team spans the United States, Romania, and India and protects the platforms that banks and wealth managers rely on every day. We hold a high bar, and we hold it together.

The people on this team own their work from start to finish, keep learning because they want to, and make the people around them better. We do not reward the loudest voice in the room. We reward the best work, delivered with respect for the people it affects.

About InvestCloud

InvestCloud, a global leader in wealth technology, aspires to enable a smarter financial future. Driving the digital transformation of the wealth management industry, the company serves a broad array of clients globally, including Wealth and Asset Managers, Wirehouses, Banks, RIAs, and Insurers. In terms of scale, the company’s clients represent more than 40 percent of the $132 trillion of total assets globally. As a leader in delivering personalization and scale across advisory programs, including unified managed accounts (UMA) and separately managed accounts (SMA), the company is committed to the success of its clients. By equipping and enabling advisors and their clients with connected technology, enhanced intelligence, and inspired experiences, InvestCloud delivers leading digital wealth management and financial planning solutions, complemented by a dynamic data warehouse, which scale across the complete wealth continuum. In 2026, InvestCloud was named CNBC World’s Top Fintech Company, a proof point of the company’s commitment to innovation and client success. Headquartered in the United States, InvestCloud serves clients around the world. For more information, visit InvestCloud.com.

Our Values

• Client Connected
• Human Centered
• Technology Forward
• Respect + Integrity
• Excellence

The actual salary will vary based on applicant’s education, experience, skills, and abilities, as well as internal equity and alignment with market data. The salary may also be adjusted based on the applicant’s geographic location. Salary range: $175,000 - $200,000. Benefits include medical/Rx, dental, vision, disability, and life/AD&D insurance plans, Flexible Savings Account (FSA), Health Savings Account (HSA), Employee Assistance Plan (EAP), health advocacy, voluntary ancillary plans (accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance), 401(k) retirement savings plan with company match, and paid time off.