Senior Cloud Security Engineer – AWS IAM & PKI (Remote)

EPAM Systems Inc; Los Angeles (CA); On-site; USD 150,000 - 160,000; Full time

Benefits offered by this job

Medical, Dental and Vision Insurance (

Job summary

EPAM Systems, Inc. is seeking a highly skilled Cloud Security Engineer to secure a multi-region AWS architecture with a focus on IAM, PKI, secrets management, and CSPM controls across PCI fintech workloads.

Responsibilities include designing secure AWS IAM policies, implementing certificate lifecycle workflows with Private CA and ACM, and integrating tools like GuardDuty, Security Hub, Macie, and IAM Access Analyzer to maintain a strong security posture.

Qualifications

• Strong hands-on experience with AWS CDK and TypeScript for security-as-code automation.
• Deep expertise in AWS Private CA (HSM-backed), ACM, mTLS trust stores, automated certificate issuance/rotation/revocation.
• Experience with GuardDuty, Security Hub, Macie, IAM Access Analyzer, and PCI-focused CSPM.
• Identity & Secrets management with IAM, Secrets Manager, KMS, and External Secrets Operator.
• Supply Chain & App security including SAST tools and code provenance (Cosign/SLSA) integrated with CDK/TS.

Responsibilities

• Design and enforce secure IAM policies, roles, permissions, SCPs, and IRSA configurations.
• Implement posture management with GuardDuty, Security Hub, CloudTrail, Macie, and IAM Access Analyzer.
• Build automated certificate lifecycles using Private CA, ACM, and PKI workflows.
• Protect data in transit and at rest using KMS, Secrets Manager, and External Secrets Operator.

Skills

AWS CDK

TypeScript

IAM

CSPM

PCI compliance

KMS

Secret management

PKI

GuardDuty

Security Hub

Macie

mTLS

External Secrets

Cosign

SLSA

Tools

ACM

IRSA

External Secrets Operator

Cosign

KMS/MRK envelope encryption

Job description

EPAM Systems, Inc. is seeking a highly skilled Cloud Security Engineer to secure a multi-region AWS architecture with a focus on IAM, PKI, secrets management, and CSPM controls across PCI fintech workloads.

Responsibilities include designing secure AWS IAM policies, implementing certificate lifecycle workflows with Private CA and ACM, and integrating tools like GuardDuty, Security Hub, Macie, and IAM Access Analyzer to maintain a strong security posture.