AWS Cloud Security Engineer

Booz Allen Hamilton; San Diego (CA); On-site; USD 69,000 - 158,000; Full time

Benefits offered by this job

Health benefits

Tuition assistance

Work-life programs

Paid leave

Professional development

Job summary

Booz Allen Hamilton is seeking an AWS Cloud Security Engineer to assess and strengthen security across large AWS environments, focusing on secure baselines, IaC, and automation. You will work with Organizations, IAM, VPCs, and security services to translate requirements into scalable engineering solutions.

You will collaborate with cloud platform teams and security stakeholders, delivering implementation-ready guidance and documentation to enable secure cloud adoption.

Qualifications

• 3+ years of experience with AWS cloud engineering, cloud security, infrastructure engineering, DevSecOps, site reliability engineering, or enterprise cloud delivery.
• Experience with AWS Organizations, organizational units, multi-account environments, IAM, roles, policies, Service Control Policies, or cross-account access.
• Experience with AWS networking, including VPCs, subnets, security groups, routing, Transit Gateway, private connectivity, DNS, load balancing, or ingress and egress controls.
• Experience with AWS security and monitoring services, including CloudTrail, AWS Config, GuardDuty, Security Hub, KMS, IAM Access Analyzer, CloudWatch, Systems Manager, or AWS Inspector
• Experience developing or reviewing Terraform, AWS CloudFormation, or Infrastructure as Code used to deploy and manage AWS resources.
• Experience in assisting with developing cloud security standards, secure configuration baselines, technical guardrails, policies, or reusable security patterns
• Experience with scripting or automation using Python, Bash, PowerShell, AWS CLI, SDKs, APIs, or engineering tools
• Experience assessing technical environments, identifying security or architecture gaps, and translating findings into practical recommendations, implementation steps, or technical documentation
• Ability to work directly with cloud engineers, architects, cybersecurity teams, application teams, governance stakeholders, and client leadership

Responsibilities

• Assess cloud security posture and identify gaps in AWS environments.
• Review AWS Organizations, landing zones, IAM, and networking for secure configurations.
• Develop Terraform/IaC and guardrails; create technical documentation.
• Collaborate with cloud architects, security engineers, and stakeholders to implement secure patterns.
• Translate security findings into practical recommendations and steps.

Skills

AWS cloud engineering

cloud security

Terraform

Infrastructure as Code

Python

Bash

AWS CLI

security assessments

communication with stakeholders

Education

Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, or Information Systems

Tools

Terraform

AWS CloudFormation

Job description

AWS Cloud Security Engineer The Opportunity

Organizations are expanding their use of AWS, but securing a large cloud environment requires more than deploying individual security tools. As an AWS cloud security engineer, you know how to assess how services are being used, establish secure configuration standards, build preventive guardrails, automate controls, and help engineering teams operate cloud environments consistently and securely. As an AWS Cloud Security Engineer on our team, you’ll support a hands‑on AWS cloud security assessment and engineering program for a large enterprise environment. You’ll help review AWS Organizations, accounts, landing zones, identity, networking, security services, workloads, policies, Infrastructure as Code, and existing security tooling to identify gaps and opportunities to strengthen the client’s cloud security posture. You’ll work with AWS Organizations, IAM, IAM Identity Center, Service Control Policies, VPC networking, CloudTrail, Config, GuardDuty, Security Hub, KMS, Systems Manager, and other AWS‑native services. You’ll assist in establishing minimum secure configuration baselines for AWS services, developing reusable Terraform and Infrastructure as Code, creating security policies and guardrails, evaluating existing cloud security tooling, and developing implementation‑ready technical documentation. This is an opportunity to combine practical AWS engineering with cloud security architecture, automation, and client delivery. You’ll work alongside experienced cloud architects and security engineers while collaborating directly with cloud platform teams, security stakeholders, application owners, governance teams, and client leadership. You’ll support work that includes AWS security assessments, landing zone reviews, identity and access management, network security, Secure copy protocol (SCP) development, secure service baselines, Infrastructure as Code, security automation, application architecture reviews, tooling optimization, and cloud governance. Your ability to translate technical requirements into scalable, repeatable engineering solutions will help clients strengthen cloud security while enabling continued adoption of AWS. Join us. The world can’t wait.

You Have

• 3+ years of experience with AWS cloud engineering, cloud security, infrastructure engineering, DevSecOps, site reliability engineering, or enterprise cloud delivery
• Experience with AWS Organizations, organizational units, multi‑account environments, IAM, roles, policies, Service Control Policies, or cross‑account access
• Experience with AWS networking, including VPCs, subnets, security groups, routing, Transit Gateway, private connectivity, DNS, load balancing, or ingress and egress controls
• Experience with AWS security and monitoring services, including CloudTrail, AWS Config, GuardDuty, Security Hub, KMS, IAM Access Analyzer, CloudWatch, Systems Manager, or AWS Inspector
• Experience developing or reviewing Terraform, AWS CloudFormation, or Infrastructure as Code used to deploy and manage AWS resources
• Experience in assisting with developing cloud security standards, secure configuration baselines, technical guardrails, policies, or reusable security patterns
• Experience with scripting or automation using Python, Bash, PowerShell, AWS CLI, SDKs, APIs, or engineering tools
• Experience assessing technical environments, identifying security or architecture gaps, and translating findings into practical recommendations, implementation steps, or technical documentation
• Ability to work directly with cloud engineers, architects, cybersecurity teams, application teams, governance stakeholders, and client leadership
• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Engineering, or Information Systems

Nice If You Have

• Experience with AWS IAM Identity Center, SAML, OIDC, permission sets, privileged access, enterprise federation, or identity governance
• Experience designing, reviewing, or supporting AWS landing zones, AWS Control Tower, account vending, centralized logging, shared services, or enterprise AWS platform architectures
• Experience in assisting with developing AWS Service Control Policies, IAM policies, resource policies, permission boundaries, or preventive cloud security controls
• Experience developing secure baselines and Infrastructure as Code for multiple AWS services in a large enterprise environment
• Experience with cloud security platforms such as Wiz, Prisma Cloud, Orca Security, Lacework, or other Cloud Security Posture Management (CSPM) or Cloud‑Native Application Protection Platform (CNAPP) technologies
• Experience with integrating security requirements into CI/CD pipelines, Git workflows, DevSecOps processes, automated testing, or policy‑as‑code
• Experience with security frameworks or standards such as NIST, CIS Benchmarks, ISO 27001, FedRAMP, or cloud security control frameworks
• Experience reviewing application architectures, dependencies, and infrastructure components and identifying opportunities to use AWS‑native services or cloud‑native design patterns
• Experience supporting large enterprise, Fortune 500, regulated, or multi‑account cloud environments
• Knowledge of Microsoft Azure or Google Cloud security

Compensation

• Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work‑life programs, and dependent care.

Full‑time and part‑time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen’s benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.

Salary at Booz Allen is determined by various factors, including but not limited to location, the individual’s particular combination of education, knowledge, skills, competencies, and experience, as well as contract‑specific affordability and organizational requirements. The projected compensation range for this position is $69,300.00 to $158,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen’s total compensation package for employees. This posting will close within 90 days from the Posting Date.

Identity Statement

As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Candidate AI Usage Policy

AI is a part of our daily work at Booz Allen, and we are committed to the responsible and ethical use of AI tools. However, we want to ensure a fair candidate process based on your own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) or other tools to assist with responses during interviews (whether in‑person or virtual) is prohibited unless permission is explicitly provided.

Work Model

Our people‑first culture prioritizes the benefits of collaboration. To support engagement and effective communication, employees working virtually are generally expected to have their cameras on during meetings.

Remote: If this position is listed as remote, there may still be occasions when you are required to work in person at a Booz Allen or customer facility.

Hybrid: If this position is listed as hybrid, you will be expected to work from a Booz Allen or customer facility, in alignment with your leadership’s expectations and the needs of the role.

Onsite: If this position is listed as onsite, work will primarily be performed full‑time at a customer facility, where employees will collaborate directly with colleagues and customers as required by the role.

Commitment to Non‑Discrimination

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.

About Booz Allen

Booz Allen is an advanced technology company. We build commercial‑grade products and solutions for America’s most critical defense, civil, and national security priorities.

Commitment to Non‑Discrimination All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.

Know Your Rights Poster Accommodations

Applicants who need a reasonable accommodation for any part of the application, hiring, or employment process because of a disability, a sincerely held religious belief, practice, or observance, or as otherwise required by applicable law should contact the Booz Allen Help Desk by calling 1-877-927-8278 or sending an email to [e-mail]. We will review requests on an individualized basis and provide reasonable accommodations consistent with applicable law.

Data Privacy

For more information on how Booz Allen uses your information, please see our Careers Privacy Policy.