Senior Cloud Security Engineer - AWS IAM & PKI

EPAM Systems

San Jose (CA)

Remote

USD 150,000 - 160,000

Full time

14 days+

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Medical, Dental and Vision Insurance (

Health Savings Account

Flexible Spending Accounts

Short-Term and Long-Term Disability

Life and AD&D Insurance

Employee Assistance Program

Unlimited LinkedIn learning

Matched 401(k)

Paid time off (15-25 days)

Paid Holidays (9)

Employee Stock Purchase Program

Discretionary annual bonus program

Discretionary Long-Term Incentive (LTI

Job summary

EPAM Systems is seeking a Cloud Security Engineer to harden a multi-region AWS architecture, architecting and automating security controls across IAM, PKI, secrets management, and CSPM for PCI-fintech workloads.

You will implement security-as-code using AWS CDK and TypeScript, manage certificates with Private CA/ACM, and leverage GuardDuty, Security Hub, Macie, and IAM Access Analyzer. This remote role cannot be performed in New York City.

Qualifications

Baseline: Strong hands-on experience with AWS CDK and TypeScript for security-as-code automation.
Deep AWS PKI & TLS expertise: AWS Private CA, ACM, automated certificate issuance/rotation.
Proficiency with GuardDuty, Security Hub, Macie, and IAM Access Analyzer.
Experience supporting PCI-scoped fintech audits and CSPM frameworks.
Identity & Secrets Management: IAM, policy boundaries, SCPs, IRSA/EKS identity, Secrets Manager, External Secrets Operator.
Supply Chain & Application Security: SAST tools (SonarQube, CodeQL), Dependabot, Cosign/SLSA integrated with CDK & TS.

Responsibilities

Design and enforce secure AWS IAM policies, roles, and SCPs.
Implement security monitoring and posture tools across AWS services.
Build and manage certificate workflows using AWS Private CA, ACM, and PKI workflows.
Secure data with AWS KMS, Secrets Manager, and External Secrets Operator.