Senior AWS IAM & Cloud Security Engineer (Remote)

EPAM Systems; McLean (VA); Remote; USD 150,000 - 160,000; Full time

Benefits offered by this job

Medical, Dental and Vision Insurance

Health Savings Account

Matched 401(k) Retirement Savings Plan

Paid Time Off

Paid Holidays

Employee Stock Purchase Program

Employee Discounts

Learning & Development

Job summary

EPAM Systems is seeking a specialized Cloud Security Engineer to secure a multi-region AWS architecture. You will architect, implement, and automate robust security controls across IAM, PKI, secrets management, and CSPM, ensuring compliance for PCI-scoped fintech workloads.

Responsibilities include designing secure IAM policies, managing CSPM tools like GuardDuty and Macie, PKI lifecycle via AWS Private CA and ACM, and protecting data with KMS and Secrets Manager. Remote role with global focus.

Qualifications

• Baseline: strong hands-on experience with AWS CDK and TypeScript for security-as-code automation.
• Deep expertise in AWS Private CA (HSM-backed), TLS, ACM, automated certificate issuance/rotation/revocation, and PayPal Security compliance workflows.
• Experience with GuardDuty, Security Hub (FSBP, CIS, NIST), Macie, and IAM Access Analyzer.
• Experience supporting PCI-scoped fintech audits and CSPM frameworks.
• Identity & Secrets Management: IAM roles, trust policies, permission boundaries, SCPs, IRSA/EKS Pod Identity, Secrets Manager, External Secrets Operator, and KMS/MRK envelope encryption.
• Supply Chain & Application Security: SAST tools (SonarQube, CodeQL), Dependabot, and software supply chain security (Cosign/SLSA) integrated with CDK & TypeScript.

Responsibilities

• Architect, implement, and automate security controls across multi-region AWS architecture.
• Design IAM policies, SCPs, and EKS Pod Identity configurations.
• Manage CSPM tools including GuardDuty, Security Hub, CloudTrail, Macie, and IAM Access Analyzer.
• Oversee PKI and certificate workflows via AWS Private CA, ACM, and mTLS.
• Secure data with KMS, Secrets Manager, and External Secrets.

Skills

Security-as-code

PCI-fintech compliance

Cloud security monitoring

Automation & IaC

Tools

AWS CDK

TypeScript

GuardDuty

Security Hub

Macie

IAM Access Analyzer

ACM

Private CA

KMS

Secrets Manager

External Secrets Operator

Cosign

SLSA

SonarQube

CodeQL

IRSA

EKS Pod Identity

SCPs

Job description

EPAM Systems is seeking a specialized Cloud Security Engineer to secure a multi-region AWS architecture. You will architect, implement, and automate robust security controls across IAM, PKI, secrets management, and CSPM, ensuring compliance for PCI-scoped fintech workloads.

Responsibilities include designing secure IAM policies, managing CSPM tools like GuardDuty and Macie, PKI lifecycle via AWS Private CA and ACM, and protecting data with KMS and Secrets Manager. Remote role with global focus.