Cloud Security Analyst

InvestCloudOct2024; United States; Remote; USD 175,000 - 200,000; Full time

Job summary

InvestCloud is seeking a Cloud Security Architect with deep AWS security expertise to design and build a secure AWS environment for our SaaS platform. You will own security across identity, networks, containers, storage, encryption, and logging, partnering with developers and infra engineers.

You will mentor engineers, set security baselines, and implement guardrails to prevent insecure configurations, while collaborating with Wiz for cloud risk remediation.

Qualifications

• Extensive AWS security expertise across multi-account environments.
• Hands-on knowledge of IAM, Organizations, SCPs, and Identity Center.
• Strong AWS networking experience (VPCs, security groups, WAF).
• Encryption expertise (KMS, CloudHSM) and key management.
• Container security with EKS/ECS and least-privilege identities.
• Experience with cloud security monitoring (CloudTrail, GuardDuty, Security Hub).
• IaC skills (Terraform or CloudFormation) and code literacy.
• Ability to explain risk to engineers and executives clearly.
• Azure security experience and Wiz or similar cloud security platform.
• AWS Security Specialty certification or equivalent depth.

Responsibilities

• Design security architecture for AWS environment and build with devs and infra teams.
• Set secure baselines for IAM, networking, containers, storage, and encryption.
• Design logging/monitoring to investigate activity across AWS accounts.
• Review cloud designs/changes and provide practical guidance.
• Build guardrails and automated checks to prevent insecure configs.
• Collaborate with Application Security Architect to fix cloud risk (Wiz).
• Write reference architectures and patterns for secure development.
• Mentor engineers across the company.

Skills

AWS security

IAM & SCP

VPC design

Container security

Cloud security monitoring

Wiz platform

Regulated industries

Communication

Azure security

AWS Security Specialty

Tools

Wiz

Terraform

CloudFormation

CloudTrail

GuardDuty

Security Hub

Job description

We are looking for a Cloud Security Architect who knows Amazon Web Services (AWS) security inside and out and wants to build, not just advise.

You will design and help build the AWS environment that runs our software-as-a-service (SaaS) platform, working shoulder to shoulder with our developers and infrastructure engineers. You will own the security of every layer: identity, networks, containers, storage, encryption, and logging.

The banks and wealth managers who use our platform trust us with their clients' financial lives, and your work is a big part of why they can.

What you will do

• Design the security architecture for our AWS environment and take part in every stage of design and build alongside our development and infrastructure teams.
• Set and maintain secure baselines for identity and access, network and firewall controls, containers and Kubernetes, storage, encryption, key management, and cryptography.
• Design security logging and monitoring so we can see and investigate activity across every AWS account and workload.
• Review cloud designs and changes and provide clear, practical answers that keep projects moving.
• Build guardrails and automated checks that stop insecure configurations before they reach production.
• Partner with our Application Security Architect to use Wiz to find and fix cloud risk, from code to runtime.
• Write the reference architectures and patterns that let teams build securely without waiting on security.
• Mentor engineers across the company.

What success looks like in your first year

• Every new service we run in AWS is secure from day one, not fixed later.
• Developers and infrastructure engineers bring you into their designs early because your involvement makes their work faster and better.
• Our AWS environment runs to a written secure standard, and anything that drifts from it is caught and corrected quickly.
• We can prove to customers, auditors, and regulators that our platform runs on secure infrastructure.

What you bring

• Typically eight or more years of experience in security engineering or architecture, with at least five focused on hands-on AWS security in multi-account environments.
• Expert knowledge of AWS identity, including IAM, AWS Organizations, service control policies, and IAM Identity Center.
• Expert knowledge of AWS networking, including VPC design, security groups, AWS Network Firewall, and AWS WAF.
• Expert knowledge of encryption, including KMS, CloudHSM, and certificate management.
• Strong container security experience with Amazon EKS or ECS, including image security, runtime protection, and least-privilege workload identity.
• Experience designing security logging with CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and a central log platform.
• A working command of cryptography, including choosing the right algorithms, rotating keys, and protecting secrets.
• Infrastructure as code skills in Terraform or CloudFormation, along with the ability to read and write code.
• Experience securing a SaaS platform for regulated customers, ideally in financial services.
• The ability to explain complex risk in plain language to engineers and executives alike.
• Microsoft Azure or Microsoft 365 security experience.
• Hands-on experience with Wiz or a similar cloud security platform.
• AWS Certified Security Specialty certification, or equivalent depth of experience.

Who you are

• You hold yourself to a world-class standard, and it shows in everything you deliver.
• You are a self-starter. You find the work that matters and finish it without being asked.
• You care about this field beyond the job description. You keep learning and building on your own because you enjoy it, and you put in the extra effort when the mission calls for it.
• You bring drive, ambition, and a positive attitude to hard problems.
• You make the people around you better. You share what you know, you never make anyone feel small, and you let your work speak for itself.

How we work

Our security team spans the United States, Romania, and India and protects the platforms that banks and wealth managers rely on every day. We hold a high bar, and we hold it together.

The people on this team own their work from start to finish, keep learning because they want to, and make the people around them better. We do not reward the loudest voice in the room. We reward the best work, delivered with respect for the people it affects.

About InvestCloud

InvestCloud, a global leader in wealth technology, aspires to enable a smarter financial future. Driving the digital transformation of the wealth management industry, the company serves a broad array of clients globally, including Wealth and Asset Managers, Wirehouses, Banks, RIAs, and Insurers. In terms of scale, the company’s clients represent more than 40 percent of the $132 trillion of total assets globally. As a leader in delivering personalization and scale across advisory programs, including unified managed accounts (UMA) and separately managed accounts (SMA), the company is committed to the success of its clients. By equipping and enabling advisors and their clients with connected technology, enhanced intelligence, and inspired experiences, InvestCloud delivers leading digital wealth management and financial planning solutions, complemented by a dynamic data warehouse, which scale across the complete wealth continuum. In 2026, InvestCloud was named CNBC World’s Top Fintech Company, a proof point of the company’s commitment to innovation and client success. Headquartered in the United States, InvestCloud serves clients around the world. For more information, visit InvestCloud.com .

Our Values

• Client Connected
• Human Centered
• Respect + Integrity

The actual salary will vary based on applicant’s education, experience, skills, and abilities, as well as internal equity and alignment with market data. The salary may also be adjusted based on the applicant’s geographic location. Salary range: $175,000 - $200,000. Benefits include medical/Rx, dental, vision, disability, and life/AD&D insurance plans, Flexible Savings Account (FSA), Health Savings Account (HSA), Employee Assistance Plan (EAP), health advocacy, voluntary ancillary plans (accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance), 401(k) retirement savings plan with company match, and paid time off.

Equal Opportunity Employer
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.