AWS Security & Compliance Engineer II-Threat Modeling & IaC

Amazon Web Services (AWS); Houston (TX); On-site; USD 159,000 - 202,000; Full time

Job summary

AWS Security Assurance Services LLC in Houston, TX seeks a security-focused engineer to lead threat modeling and architecture reviews for customer engagements, building risk-based controls and policy-as-code.

You will implement SCPs/RCPs, Cedar, Rego, and automated remediation workflows, ensuring secure-by-design IaC for Landing Zones, Zero-Trust, and AI/ML workloads, while enforcing least privilege and encryption.

Qualifications

• Experience in threat modeling or risk identification techniques.
• Bachelor's degree in STEM or equivalent IT security experience.
• Strong programming/scripting for security automation.
• Experience leading security investigations and communicating with technical and business audiences.

Responsibilities

• Lead threat modeling and security design reviews for customer engagements.
• Design and implement policy-as-code and automated remediation workflows.
• Build secure-by-design IaC controls for Landing Zones, Control Tower, Zero-Trust architectures, and AI/ML workloads.
• Apply security best practices for authentication, authorization, data handling, encryption, and least privilege.
• Write IaC and detections in Python, Terraform, AWS CDK, CloudFormation, and Rego.
• Build continuous compliance monitoring and audit-ready evidence pipelines.

Skills

Threat modeling

Security design reviews

Architecture reviews

Policy as code

Python

Terraform

AWS CDK

CloudFormation

Rego

Cross-team collaboration

Education

Bachelor's degree in STEM

Tools

Terraform

AWS CDK

CloudFormation

cfn-guard

OPA Rego

Cedar

Job description

AWS Security Assurance Services LLC in Houston, TX seeks a security-focused engineer to lead threat modeling and architecture reviews for customer engagements, building risk-based controls and policy-as-code.

You will implement SCPs/RCPs, Cedar, Rego, and automated remediation workflows, ensuring secure-by-design IaC for Landing Zones, Zero-Trust, and AI/ML workloads, while enforcing least privilege and encryption.