AWS CLOUD SECURITY & GUARDRAILS ENGINEER (Must have active TS/SCI clearance)

NorthHill Technology Resources; Herndon (VA); On-site; USD 140,000 - 190,000; Full time

Job summary

NorthHill Technology Resources is seeking an experienced AWS Cloud Security & Guardrails Engineer to join a mission-critical, security-sensitive program. This on-site role requires TS/SCI clearance and proximity to approved secure work locations including Herndon, VA.

The engineer will shape security architecture for AWS platforms and translate requirements into practical guardrails for engineering teams. The role involves building next-generation cloud infrastructure and integration platforms

Qualifications

• 5+ years in engineering.
• 3+ years hands-on AWS experience.
• Strong AWS IAM, KMS, logging, and cloud security architecture knowledge.
• Experience reviewing technical implementations against security requirements.
• Hands-on AWS cloud experience and ability to work in highly controlled environments.

Responsibilities

• Design and improve AWS IAM policies, encryption controls, and centralized logging patterns.
• Review cloud architectures and infrastructure code for security risks.
• Support security assessment documentation and evidence collection.
• Partner with engineering teams to embed reusable security guardrails in deployment workflows.

Skills

AWS IAM

KMS

Logging

Cloud security architecture

Security requirements review

Hands-on AWS

Job description

One of our premier clients is seeking an experienced AWS Cloud Security & Guardrails Engineer to join a highly skilled team delivering advanced cloud engineering capabilities for a mission-critical, security-sensitive initiative. This is a full-time position requiring an active Top Secret/SCI clearance. Help shape the security architecture of sophisticated AWS platforms from the ground up. You will translate security requirements into practical identity, encryption, and observability guardrails that engineering teams can build on with confidence. You will work with experienced technical partners in a collaborative environment where careful engineering and measurable results matter.

The program you will be supporting is a highly classified, mission-critical modernization initiative. Your roles will be to help build next-generation cloud infrastructure and integration platforms that connect fragmented intelligence, operational data, and mission systems through APIs, MCP servers, and cloud-native technologies.

Key Responsibilities:

• - Design and improve AWS IAM policies, encryption controls, and centralized logging patterns.
• - Review cloud architectures and infrastructure code for security risks.
• - Support security assessment documentation and evidence collection.
• - Partner with engineering teams to embed reusable security guardrails in deployment workflows.

Qualifications:

• - 5+ years in engineering, including 3+ years of hands-on AWS experience.
• - Strong AWS IAM, KMS, logging, and cloud security architecture knowledge.
• - Experience reviewing technical implementations against security requirements.
• - Hands-on AWS cloud experience and ability to work effectively in highly controlled environments.

Preferred Qualifications:

• - Experience with automated policy validation or infrastructure-as-code security.
• - Experience supporting formal security authorization activities.
• - Relevant AWS professional or specialty certifications; Security+ or CISSP where applicable.

Requirements:

• - Active TS/SCI clearance; must be eligible for applicable SCI read-on/indoctrination and additional program-specific access approvals.
• - Must reside within commuting distance of one of the following 4 approved secure work locations: Herndon, VA; Washington, DC; Seattle, WA; or Denver, CO.
• - Regular on-site work in an approved secure facility and occasional work at authorized customer facilities may be required. This is not a remote position.
• - Full-time position, on-site
• - Please note that pursuant to a government contract, this specific position requires U.S. citizenship status