Senior AWS Cloud Security Engineer: IAM, PKI & CSPM

EPAM Systems Inc; New York, Northern (NY, KY); Hybrid; USD 150,000 - 160,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

Health Savings Account

Flexible Spending Accounts

Disability Insurance

Life Insurance

Employee Assistance Program

401(k) Retirement Plan

Paid Time Off

Paid Holidays

Legal Plan

Identity Protection

Pet Insurance

Employee Stock Purchase Program

Bonus Program

Long-Term Incentive

Remote work in NYC

Job summary

EPAM Systems Inc in New York City seeks a Cloud Security Engineer to design, implement, and automate security controls across multi-region AWS architecture, focusing on IAM, PKI, secrets management and CSPM to meet PCI fintech requirements.

You will work with GuardDuty, Security Hub, Macie, ACM, Private CA, KMS, IRSA, and CDK with TypeScript to secure infrastructure and pipelines. This role offers remote work within New York City and a competitive base salary.

Qualifications

• Strong hands-on experience with AWS CDK and TypeScript for security automation.
• Expert in IAM, SCPs, TLS/mTLS, PKI, and certificate workflows.
• Experience with CSPM tools and PCI-fintech compliance.

Responsibilities

• Design and enforce secure AWS IAM policies, roles, and permission boundaries.
• Implement cloud posture tools (GuardDuty, Security Hub, Macie, IAM Access Analyzer).
• Build PKI and certificate management workflows (AWS Private CA, ACM, mTLS).
• Secure data with KMS, Secrets Manager, and external secrets integrations.
• Support SAST/software supply chain security (SonarQube, CodeQL, Dependabot) in CDK/TS.

Skills

AWS CDK

TypeScript

IAM policies

IRSA / EKS Pod Identity

Posture management

PCI compliance

Security-as-code

GuardDuty / Security Hub

Key management

Secrets management

Tools

Cosign

SLSA

Dependabot

CodeQL

Cosign/SLSA

Job description

EPAM Systems Inc in New York City seeks a Cloud Security Engineer to design, implement, and automate security controls across multi-region AWS architecture, focusing on IAM, PKI, secrets management and CSPM to meet PCI fintech requirements.

You will work with GuardDuty, Security Hub, Macie, ACM, Private CA, KMS, IRSA, and CDK with TypeScript to secure infrastructure and pipelines. This role offers remote work within New York City and a competitive base salary.