AWS Cloud Security Engineer

Jobgether; Oregon; Hybrid; USD 130,000 - 180,000; Full time

Job summary

Partner Company in the United States seeks an AWS Cloud Security Engineer to design, automate, and deploy security and governance across multi-account AWS environments. You will author SCPs and RCPs, implement policy-as-code with Terraform and AFT, and collaborate with customers to deliver secure cloud foundations.

You will contribute to automated compliance, security analytics, and reusable resources while translating security needs into policy definitions, testing in sandbox environments, and

Qualifications

• Hands-on AWS security engineering experience with SCPs and RCPs.
• Strong Terraform and Infrastructure-as-Code expertise.
• Experience with multi-account cloud governance and AWS Organizations.
• Proficiency in IAM Access Analyzer and policy evaluation best practices.
• Must be legally authorized to work in the United States.

Responsibilities

• Design, develop, and deploy automated security, governance, and DevSecOps solutions across AWS environments.
• Author and implement SCPs/RCPs using Terraform and AWS Control Tower AFT pipelines.
• Help customers strengthen cloud security posture and guidance throughout cloud transformation.
• Develop policy-as-code controls, testing, and automated deployment pipelines.
• Create reusable playbooks, runbooks, and technical content for ongoing operations.

Skills

AWS security

Terraform

AWS Control Tower

AFT (Account Factory for Terraform)

IAM Access Analyzer

Python

Tools

AWS CLI

CloudFormation

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an AWS Cloud Security Engineer based in the United States.

Join a cloud security engineering team driving large-scale AWS governance and security transformation initiatives. In this role, you will design, automate, and deploy security and compliance solutions across complex, multi-account AWS environments. You will focus on implementing Service Control Policies (SCPs), Resource Control Policies (RCPs), and policy-as-code frameworks using Terraform and AWS Control Tower Account Factory for Terraform (AFT). Working closely with customers, you will provide hands‑on technical guidance and help build secure, scalable cloud foundations. You will also contribute to automated compliance frameworks, security analytics, and reusable technical resources. This is an opportunity to combine deep AWS expertise, consulting skills, and practical innovation to deliver measurable customer outcomes.

Accountabilities

• You will help customers strengthen their cloud security posture by designing and implementing automated governance, compliance, and security capabilities.
• Your responsibilities will include:AWS Governance and Security ImplementationAdvise customers on cloud adoption strategies and provide technical and strategic guidance throughout their cloud transformation journeys.
• Design, develop, and deploy security solutions across AWS environments.
• Author Service Control Policies (SCPs) and Resource Control Policies (RCPs) using Terraform.
• Implement and deploy policies through AWS Control Tower AFT pipelines.
• Test policies in sandbox environments, assess their potential impact, and conduct blast radius analysis.
• Progress validated policies from Sandbox Organizational Units to NCZ, DPZ, and Critical Zone environments.
• Develop VPC endpoint, Amazon S3, and AWS KMS resource‑based policies.
• Apply IAM Access Analyzer and policy evaluation capabilities to strengthen access governance.
• Automation & Compliance FrameworksDesign and implement automated security, compliance, and DevSecOps solutions.
• Help build self‑service AWS account frameworks, including organizational hierarchies, configuration templates, and automated account provisioning pipelines.
• Develop continuous delivery frameworks that establish secure, tested, and repeatable AWS infrastructure with minimal manual intervention.
• Translate customer security and compliance requirements into policy definitions and automated controls.
• Build policy‑as‑code solutions covering preventative, detective, and responsive controls.
• Develop logical tests and frameworks that validate infrastructure configurations, block non‑compliant builds, trigger automated responses, or generate alerts.
• Create reusable playbooks, code examples, reports, and runbooks to support implementation and ongoing operations.
• Security Analytics & MonitoringDesign frameworks to collect, transform, and interpret security event data across AWS environments.
• Identify appropriate services and tools for security monitoring, threat detection, and reporting.
• Implement centralized AWS Security Hub capabilities and configure GuardDuty for security event monitoring across accounts.
• Configure Amazon Macie to identify sensitive data, including across designated S3 buckets.
• Develop AWS Config rules to enforce security configurations aligned with the CIS AWS Foundations Benchmark.
• Implement Amazon Inspector to identify vulnerabilities and security findings in EC2 environments.
• Enable CloudTrail for API activity monitoring and VPC Flow Logs for network traffic visibility.
• Evaluate additional security services and products based on customer requirements.
• Customer Engagement and Technical LeadershipBuild trusted relationships with customers and serve as a deep technical resource throughout their cloud security initiatives.
• Collaborate with customer stakeholders to understand challenges, recommend solutions, and translate requirements into measurable results.
• Develop high‑quality technical content, including automation tools, reference architectures, technical briefs, and white papers.
• Support solution development by communicating customer feedback and real‑world implementation challenges to internal teams.
• Contribute to technical roadmaps and recommend improvements to existing capabilities and service offerings.
• Prepare and deliver runbooks, documentation, and knowledge‑transfer sessions.
• Collaborate with marketing and alliance teams on technical blog posts and internal case studies to support thought leadership.

Requirements

• The ideal candidate combines hands‑on AWS security engineering expertise with strong Infrastructure‑as‑Code capabilities and experience delivering technical solutions in customer‑facing environments.
• Technical ExperienceDemonstrated hands‑on experience authoring and implementing AWS Service Control Policies (SCPs) and Resource Control Policies (RCPs).
• Strong Terraform and Infrastructure‑as‑Code expertise.
• Experience with AWS Organizations and multi‑account cloud governance.
• Practical experience with AWS Control Tower and Account Factory for Terraform (AFT).
• Knowledge of IAM Access Analyzer, IAM policy evaluation, and access management best practices.
• Experience developing policies for VPC endpoints, Amazon S3, and AWS KMS.
• Proficiency in Python programming; experience with Java and Bash is also relevant.
• Experience designing and automating security, compliance, or DevSecOps solutions on AWS.
• Ability to develop and test policy‑as‑code controls, automated deployment pipelines, and security monitoring workflows.
• Experience authoring technical documentation, runbooks, playbooks, and delivering knowledge‑transfer sessions.
• AWS Certified Security – Specialty certification.

Relevant Tools and Technologies

Experience with some of the following technologies and services is valuable:

Programming and infrastructure

• Python, Java, Bash, Terraform, CloudFormation, AWS CDK, and AWS CLI.

DevOps and automation

• Jenkins, GitLab, Git, CodePipeline, CodeBuild, CodeCommit, and CodeDeploy.

Security and compliance

• Vault, Splunk, OWASP, Trend Micro, Palo Alto, Fortify, Twistlock, and Aqua Security.

AWS storage and compute

• Amazon S3, Lambda, EC2, EKS, ECS, and ECR.

AWS networking

• VPC, Route 53, API Gateway, and Direct Connect.

AWS governance and management

• Control Tower, Organizations, CloudWatch, Auto Scaling, Config, CloudTrail, Service Catalog, and Systems Manager.

AWS security services

• IAM, Inspector, KMS, Secrets Manager, Security Hub, Detective, GuardDuty, Macie, HSM, Certificate Manager, WAF, Shield, and Firewall Manager.

Cloud architecture

• AWS Landing Zone frameworks.

Professional Skills and Eligibility

• Experience in customer‑facing software or technology roles.
• Strong communication, collaboration, organization, and problem‑solving skills.
• Ability to provide clear technical guidance and build trusted customer relationships.
• A structured, patient, and proactive approach to complex technical challenges.
• Demonstrated ownership, continuous learning, and a commitment to delivering high‑quality outcomes.
• Must be legally authorized to work in the United States without current or future employer sponsorship.

Benefits

• Full‑time employment opportunity.
• Opportunity to contribute to large‑scale AWS cloud governance and security transformation initiatives.
• Exposure to complex enterprise cloud environments and a broad range of AWS security technologies.
• Opportunities to develop technical expertise through customer engagements, automation projects, and knowledge sharing.