AWS Cloud Security Engineer

Join a cloud security engineering team driving large-scale AWS governance and security transformation initiatives. In this role, you will design, automate, and deploy security and compliance solutions across complex, multi-account AWS environments. You will focus on implementing Service Control Policies (SCPs), Resource Control Policies (RCPs), and policy-as-code frameworks using Terraform and AWS Control Tower Account Factory for Terraform (AFT). Working closely with customers, you will provide hands-on technical guidance and help build secure, scalable cloud foundations. You will also contribute to automated compliance frameworks, security analytics, and reusable technical resources. This is an opportunity to combine deep AWS expertise, consulting skills, and practical innovation to deliver measurable customer outcomes.

• Advise customers on cloud adoption strategies and provide technical and strategic guidance throughout their cloud transformation journeys.

• Design, develop, and deploy security solutions across AWS environments.

• Author Service Control Policies (SCPs) and Resource Control Policies (RCPs) using Terraform.

• Implement and deploy policies through AWS Control Tower AFT pipelines.

• Test policies in sandbox environments, assess their potential impact, and conduct blast radius analysis.

• Progress validated policies from Sandbox Organizational Units to NCZ, DPZ, and Critical Zone environments.

• Develop VPC endpoint, Amazon S3, and AWS KMS resource-based policies.

• Apply IAM Access Analyzer and policy evaluation capabilities to strengthen access governance.

• Design and implement automated security, compliance, and DevSecOps solutions.

• Help build self-service AWS account frameworks, including organizational hierarchies, configuration templates, and automated account provisioning pipelines.

• Develop continuous delivery frameworks that establish secure, tested, and repeatable AWS infrastructure with minimal manual intervention.

• Translate customer security and compliance requirements into policy definitions and automated controls.

• Build policy-as-code solutions covering preventative, detective, and responsive controls.

• Develop logical tests and frameworks that validate infrastructure configurations, block non-compliant builds, trigger automated responses, or generate alerts.

• Create reusable playbooks, code examples, reports, and runbooks to support implementation and ongoing operations.

• Design frameworks to collect, transform, and interpret security event data across AWS environments.

• Identify appropriate services and tools for security monitoring, threat detection, and reporting.

• Implement centralized AWS Security Hub capabilities and configure GuardDuty for security event monitoring across accounts.

• Configure Amazon Macie to identify sensitive data, including across designated S3 buckets.

• Develop AWS Config rules to enforce security configurations aligned with the CIS AWS Foundations Benchmark.

• Implement Amazon Inspector to identify vulnerabilities and security findings in EC2 environments.

• Enable CloudTrail for API activity monitoring and VPC Flow Logs for network traffic visibility.

• Evaluate additional security services and products based on customer requirements.

• Build trusted relationships with customers and serve as a deep technical resource throughout their cloud security initiatives.

• Collaborate with customer stakeholders to understand challenges, recommend solutions, and translate requirements into measurable results.

• Develop high-quality technical content, including automation tools, reference architectures, technical briefs, and white papers.

• Support solution development by communicating customer feedback and real-world implementation challenges to internal teams.

• Contribute to technical roadmaps and recommend improvements to existing capabilities and service offerings.

• Prepare and deliver runbooks, documentation, and knowledge-transfer sessions.

• Collaborate with marketing and alliance teams on technical blog posts and internal case studies to support thought leadership.

The ideal candidate combines hands-on AWS security engineering expertise with strong Infrastructure-as-Code capabilities and experience delivering technical solutions in customer-facing environments.

• Demonstrated hands-on experience authoring and implementing AWS Service Control Policies (SCPs) and Resource Control Policies (RCPs).

• Strong Terraform and Infrastructure-as-Code expertise.

• Experience with AWS Organizations and multi-account cloud governance.

• Practical experience with AWS Control Tower and Account Factory for Terraform (AFT).

• Knowledge of IAM Access Analyzer, IAM policy evaluation, and access management best practices.

• Experience developing policies for VPC endpoints, Amazon S3, and AWS KMS.

• Proficiency in Python programming; experience with Java and Bash is also relevant.

• Experience designing and automating security, compliance, or DevSecOps solutions on AWS.

• Ability to develop and test policy-as-code controls, automated deployment pipelines, and security monitoring workflows.

• Experience authoring technical documentation, runbooks, playbooks, and delivering knowledge-transfer sessions.

• AWS Certified Security – Specialty certification.

Experience with some of the following technologies and services is valuable:

• Experience in customer-facing software or technology roles.

• Strong communication, collaboration, organization, and problem-solving skills.

• Ability to provide clear technical guidance and build trusted customer relationships.

• A structured, patient, and proactive approach to complex technical challenges.

• Demonstrated ownership, continuous learning, and a commitment to delivering high-quality outcomes.

• Must be legally authorized to work in the United States without current or future employer sponsorship.