AWS Cloud Security Engineer

Jobgether; United States; In loco; USD 120.000 - 190.000; Tempo pieno

Descrizione del lavoro

Jobgether seeks an AWS Cloud Security Engineer to design, automate, and deploy security solutions across multi-account AWS environments. You will craft SCPs/RCPs with Terraform and operate within AWS Control Tower Account Factory for Terraform (AFT), delivering automated governance, compliance, and security capabilities for customers.

You will also contribute to security analytics, runbooks, and reusable resources while engaging directly with clients to translate requirements into measurable

Competenze

• Hands-on AWS security engineering with Infrastructure-as-Code.
• Experience authoring SCPs and RCPs for multi-account AWS environments.
• Experience with AWS Organizations and multi-account governance.
• Experience with AWS Control Tower and Account Factory for Terraform (AFT).
• Knowledge of IAM Access Analyzer and policy evaluation.
• Experience developing policies for S3, KMS, and VPC endpoints.
• Proficiency in Python; Java and Bash are a plus.
• Ability to design policy-as-code and automated deployment pipelines.
• AWS Certified Security – Specialty certification is expected.

Mansioni

• Advise customers on cloud adoption and governance strategies.
• Design, develop, and deploy security solutions across AWS environments.
• Author SCPs and RCPs using Terraform.
• Implement policies via AWS Control Tower AFT pipelines.
• Test policies in sandbox and perform blast radius analysis.
• Move validated policies across environments (Sandbox, NCZ, DPZ, Critical Zone).
• Develop resource-based policies for S3, KMS, and VPC endpoints.
• Apply IAM Access Analyzer and policy evaluation to strengthen access governance.
• Design automated security, compliance, and DevSecOps solutions.
• Build self-service AWS account frameworks and automated provisioning pipelines.
• Create reusable playbooks, code samples, and runbooks for operations.

Conoscenze

Communication

Collaboration

Organization

Problem-solving

Formazione

AWS Certified Security – Specialty

Strumenti

Terraform

AWS Control Tower

AFT (Account Factory for Terraform)

IAM Access Analyzer

AWS KMS

Amazon S3

AWS Config

CloudTrail

GuardDuty

Macie

Python

Descrizione del lavoro

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an AWS Cloud Security Engineer based in the United States.

Join a cloud security engineering team driving large-scale AWS governance and security transformation initiatives. In this role, you will design, automate, and deploy security and compliance solutions across complex, multi-account AWS environments. You will focus on implementing Service Control Policies (SCPs), Resource Control Policies (RCPs), and policy-as-code frameworks using Terraform and AWS Control Tower Account Factory for Terraform (AFT). Working closely with customers, you will provide hands‑on technical guidance and help build secure, scalable cloud foundations. You will also contribute to automated compliance frameworks, security analytics, and reusable technical resources. This is an opportunity to combine deep AWS expertise, consulting skills, and practical innovation to deliver measurable customer outcomes.

Accountabilities

Responsibilities

You will help customers strengthen their cloud security posture by designing and implementing automated governance, compliance, and security capabilities. Your responsibilities will include:

AWS Governance and Security Implementation

• Advise customers on cloud adoption strategies and provide technical and strategic guidance throughout their cloud transformation journeys.
• Design, develop, and deploy security solutions across AWS environments.
• Author Service Control Policies (SCPs) and Resource Control Policies (RCPs) using Terraform.
• Implement and deploy policies through AWS Control Tower AFT pipelines.
• Test policies in sandbox environments, assess their potential impact, and conduct blast radius analysis.
• Progress validated policies from Sandbox Organizational Units to NCZ, DPZ, and Critical Zone environments.
• Develop VPC endpoint, Amazon S3, and AWS KMS resource‑based policies.
• Apply IAM Access Analyzer and policy evaluation capabilities to strengthen access governance.

Automation and Compliance Frameworks

• Design and implement automated security, compliance, and DevSecOps solutions.
• Help build self‑service AWS account frameworks, including organizational hierarchies, configuration templates, and automated account provisioning pipelines.
• Develop continuous delivery frameworks that establish secure, tested, and repeatable AWS infrastructure with minimal manual intervention.
• Translate customer security and compliance requirements into policy definitions and automated controls.
• Build policy‑as‑code solutions covering preventative, detective, and responsive controls.
• Develop logical tests and frameworks that validate infrastructure configurations, block non‑compliant builds, trigger automated responses, or generate alerts.
• Create reusable playbooks, code examples, reports, and runbooks to support implementation and ongoing operations.

Security Analytics and Monitoring

• Design frameworks to collect, transform, and interpret security event data across AWS environments.
• Identify appropriate services and tools for security monitoring, threat detection, and reporting.
• Implement centralized AWS Security Hub capabilities and configure GuardDuty for security event monitoring across accounts.
• Configure Amazon Macie to identify sensitive data, including across designated S3 buckets.
• Develop AWS Config rules to enforce security configurations aligned with the CIS AWS Foundations Benchmark.
• Implement Amazon Inspector to identify vulnerabilities and security findings in EC2 environments.
• Enable CloudTrail for API activity monitoring and VPC Flow Logs for network traffic visibility.
• Evaluate additional security services and products based on customer requirements.

Customer Engagement and Technical Leadership

• Build trusted relationships with customers and serve as a deep technical resource throughout their cloud security initiatives.
• Collaborate with customer stakeholders to understand challenges, recommend solutions, and translate requirements into measurable results.
• Develop high‑quality technical content, including automation tools, reference architectures, technical briefs, and white papers.
• Support solution development by communicating customer feedback and real‑world implementation challenges to internal teams.
• Contribute to technical roadmaps and recommend improvements to existing capabilities and service offerings.
• Prepare and deliver runbooks, documentation, and knowledge‑transfer sessions.
• Collaborate with marketing and alliance teams on technical blog posts and internal case studies to support thought leadership.

Requirements

The ideal candidate combines hands‑on AWS security engineering expertise with strong Infrastructure-as-Code capabilities and experience delivering technical solutions in customer‑facing environments.

Technical Experience

• Demonstrated hands‑on experience authoring and implementing AWS Service Control Policies (SCPs) and Resource Control Policies (RCPs).
• Strong Terraform and Infrastructure-as-Code expertise.
• Experience with AWS Organizations and multi‑account cloud governance.
• Practical experience with AWS Control Tower and Account Factory for Terraform (AFT).
• Knowledge of IAM Access Analyzer, IAM policy evaluation, and access management best practices.
• Experience developing policies for VPC endpoints, Amazon S3, and AWS KMS.
• Proficiency in Python programming; experience with Java and Bash is also relevant.
• Experience designing and automating security, compliance, or DevSecOps solutions on AWS.
• Ability to develop and test policy‑as‑code controls, automated deployment pipelines, and security monitoring workflows.
• Experience authoring technical documentation, runbooks, playbooks, and delivering knowledge‑transfer sessions.
• AWS Certified Security – Specialty certification.

Relevant Tools and Technologies

Experience with some of the following technologies and services is valuable:

• Programming and infrastructure: Python, Java, Bash, Terraform, CloudFormation, AWS CDK, and AWS CLI.
• DevOps and automation: Jenkins, GitLab, Git, CodePipeline, CodeBuild, CodeCommit, and CodeDeploy.
• Security and compliance: Vault, Splunk, OWASP, Trend Micro, Palo Alto, Fortify, Twistlock, and Aqua Security.
• AWS storage and compute: Amazon S3, Lambda, EC2, EKS, ECS, and ECR.
• AWS networking: VPC, Route 53, API Gateway, and Direct Connect.
• AWS governance and management: Control Tower, Organizations, CloudWatch, Auto Scaling, Config, CloudTrail, Service Catalog, and Systems Manager.
• AWS security services: IAM, Inspector, KMS, Secrets Manager, Security Hub, Detective, GuardDuty, Macie, HSM, Certificate Manager, WAF, Shield, and Firewall Manager.
• Cloud architecture: AWS Landing Zone frameworks.

Professional Skills And Eligibility

• Experience in customer‑facing software or technology roles.
• Strong communication, collaboration, organization, and problem‑solving skills.
• Ability to provide clear technical guidance and build trusted customer relationships.
• A structured, patient, and proactive approach to complex technical challenges.
• Demonstrated ownership, continuous learning, and a commitment to delivering high‑quality outcomes.
• Must be legally authorized to work in the United States without current or future employer sponsorship.

Benefits

• Full‑time employment opportunity.
• Opportunity to contribute to large-scale AWS cloud governance and security transformation initiatives.
• Exposure to complex enterprise cloud environments and a broad range of AWS security technologies.
• Opportunities to develop technical expertise through customer engagements, automation projects, and knowledge sharing.