Cloud Guardrails Engineer — Remote/Hybrid, Secret Clearance

D9Tech Resources LLC; Arlington (VA); Hybrid; USD 140,000 - 210,000; Full time

Job summary

D9Tech Resources is seeking a cloud security engineer with active clearance to design and enforce guardrails in a multi-account AWS environment. You will author policy layers, IAM boundaries, and automated remediation while coordinating with the authorization team.

The role supports remote or hybrid work across CONUS, with occasional on-site accreditation activities for government programs. Citizenship is required for this role and security clearances apply.

Qualifications

• Active Secret clearance or higher.
• U.S. citizenship.
• Hands-on experience in a multi-account AWS Organizations environment, including OU design and account structure.
• Authorship of Service Control Policies; familiarity with Resource Control Policies and data perimeter patterns.
• Deep IAM fluency: roles, trust policies, condition keys, and permission boundaries.
• Production experience with AWS Config rules, conformance packs, and automated remediation.
• Working knowledge of KMS key policies and encryption controls.
• Infrastructure as code proficiency, since guardrails are deployed and versioned as code.

Responsibilities

• Author the policy layer. Write, test, and version Service Control Policies and Resource Control Policies across the AWS Organizations structure, including region locks and data perimeter controls.
• Design permission boundaries. Build IAM permission boundaries and delegated administration models that let account owners move quickly inside a fenced blast radius.
• Codify detection. Develop AWS Config rules and conformance packs mapped to the control set, and wire automated remediation through Systems Manager or Lambda.
• Own the key material. Design KMS customer-managed key policies, rotation, grants, and cross-account access patterns that hold up under review.
• Run Security Hub as a working queue. Tune standards and findings, suppress the noise with justification, and drive real remediation instead of dashboard maintenance.
• Prove the guardrails work. Build test cases that attempt the prohibited action and confirm the policy denies it, then keep those tests running as the environment changes.
• Partner with the authorization team. Supply the technical evidence, artifacts, and control narratives that support the accreditation package without owning the package yourself.

Skills

IAM fluency

Service Control Policies

AWS Config rules

Python scripting

KMS policies

AWS Organizations

Data perimeter controls

Tools

AWS Config

AWS Lambda

AWS Systems Manager

KMS

CloudFormation (IaC)

AWS Organizations

Job description

D9Tech Resources is seeking a cloud security engineer with active clearance to design and enforce guardrails in a multi-account AWS environment. You will author policy layers, IAM boundaries, and automated remediation while coordinating with the authorization team.

The role supports remote or hybrid work across CONUS, with occasional on-site accreditation activities for government programs. Citizenship is required for this role and security clearances apply.