Senior Cloud Security Engineer - AWS & CNAPP

Guardian Life; Bethlehem (Northampton County); Hybrid; USD 119,000 - 195,000; Full time

Job summary

Guardian Life is seeking a Senior Cloud Security Engineer to advance AWS security across CNAPP, CSPM, PKI, and identity controls. You will translate requirements into scalable security patterns and collaborate with Cloud Engineering, DevOps, Architecture, and Compliance to strengthen Guardian's cloud posture.

The role emphasizes automating security in IaC/CI/CD, implementing least-privilege access, and maintaining compliance with regulatory frameworks in a hybrid environment across Holmdel/NJ,

Qualifications

• 5+ years of experience in IT, cybersecurity, cloud engineering, or related disciplines.
• 5+ years of hands-on AWS security experience, including strong knowledge of IAM, PKI, CSPM, and CNAPP capabilities.
• Hands-on experience designing and implementing AWS identity controls, including IAM Identity Center, least-privilege policies, Service Control Policies (SCPs), cross-account access, and RBAC/ABAC models.
• Experience deploying and managing AWS Key Management Service (KMS), AWS Certificate Manager (ACM), and enterprise PKI capabilities.
• Experience implementing or operating CNAPP and CSPM platforms, such as Wiz, Prisma Cloud, and AWS Security Hub for posture management, workload protection, risk prioritization, and remediation.
• Strong understanding of cloud security principles, including zero trust, encryption at rest and in transit, workload and container security, identity boundaries, and network security.
• Experience with Infrastructure as Code (IaC) and security automation using technologies such as Terraform, CloudFormation, CI/CD pipelines, and shift-left security practices.
• Experience with security and compliance frameworks such as NIST, CIS, SOC 2, SOX, NYDFS, and Model Audit Rule (MAR), as well as the AWS Well-Architected Framework Security Pillar.

Responsibilities

• Implement, and continuously improve AWS security capabilities spanning identity, cryptography and PKI, cloud security posture, and cloud-native application protection.
• Engineer scalable AWS access controls, including IAM policies, SCPs, cross-account access models, and least-privilege patterns.
• Implement and enhance cloud security controls for continuous monitoring, threat detection, vulnerability management, workload protection, and automated remediation across the application lifecycle.
• Integrate AWS security capabilities with enterprise CNAPP and CSPM platforms and help operationalize security controls from code through runtime.
• Manage and enhance cloud cryptographic capabilities, including AWS KMS, ACM, encryption controls, certificate management, and enterprise PKI integrations.
• Assess the AWS security landscape, identify control gaps and emerging risks, and drive improvements across identity, encryption, workloads, containers, and other cloud security domains.
• Partner with Cloud Architecture, DevOps, application teams, and business stakeholders to gather requirements and translate them into technical designs, reusable security patterns, and guardrails.
• Develop automation and integrate security controls into Infrastructure as Code and CI/CD processes to identify and remediate risk earlier in the development lifecycle.
• Perform advanced analysis of cloud security posture and runtime risks and develop meaningful reporting, documentation, and presentations for technical and business stakeholders.
• Establish and support cloud governance and control processes aligned with enterprise security, regulatory, and audit requirements.
• Develop engineering documentation and operational runbooks that improve consistency, scalability, and audit readiness.
• Collaborate across Cybersecurity, Architecture, Cloud Engineering, Infrastructure, Compliance, and application teams to ensure cloud security capabilities align with enterprise strategy.
• Stay current on AWS security capabilities, CNAPP technologies, cloud-native threats, cryptographic technologies, and industry best practices, and apply that knowledge to continuously strengthen Guardian's cloud security posture.

Skills

AWS security

IAM & PKI

CNAPP/CSPM

KMS/ACM

IaC security

Security automation

Threat analysis

Zero trust

RBAC/ABAC

Cross‑team collab

Education

Bachelor's degree

Tools

Wiz

Prisma Cloud

AWS Security Hub

Job description

Guardian Life is seeking a Senior Cloud Security Engineer to advance AWS security across CNAPP, CSPM, PKI, and identity controls. You will translate requirements into scalable security patterns and collaborate with Cloud Engineering, DevOps, Architecture, and Compliance to strengthen Guardian's cloud posture.

The role emphasizes automating security in IaC/CI/CD, implementing least-privilege access, and maintaining compliance with regulatory frameworks in a hybrid environment across Holmdel/NJ,