InfoSec Governance Specialist

RESPONSIBILITIES:
Kforce has a client in NYC that is seeking an InfoSec Governance Specialist.

Key Responsibilities:
* Design and govern AWS IAM controls across users, services, and workloads, including roles, trust policies, permission boundaries, SCPs, STS/AssumeRole, cross-account access, and least-privilege models
* Evaluate end-to-end identity and authentication flows using OAuth 2.0, OIDC, JWT, token exchange, delegation, and on-behalf-of patterns to ensure user identity and authorization are maintained across services and data
* Govern Amazon EKS workload identity, including IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, namespaces, and workload permissions
* Assess AWS cloud and network security, including PrivateLink, VPC endpoints, endpoint policies, security groups, segmentation, EKS posture, workload isolation, and container security
* Manage security standards around AWS KMS and Secrets Manager, including encryption, key policies, secrets access, key separation, and credential protection
* Establish data classification, entitlement, and authorization models that enforce least-privilege access to sensitive and regulated data
* Strengthen software supply chain security through SBOMs, image signing/verification, ECR scanning, vulnerability management, and controls preventing untrusted artifacts from deployment
* Use GuardDuty, Security Hub, and AWS Config to identify risks, configuration drift, and policy violations while helping automate security guardrails and remediation
* Conduct practical threat modeling across identities, APIs, workloads, networks, and data, identifying risks such as privilege escalation, credential theft, unauthorized access, and compromised workloads
* Partner closely with engineering and architecture teams to translate security and governance requirements into practical, scalable technical controls

REQUIREMENTS:
* Experience securing Kubernetes environments, ideally Amazon EKS.
* Understanding of IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, and workload identity
* Experience with AWS KMS and Secrets Manager
* Knowledge of AWS networking and private access patterns, including VPCs, PrivateLink, VPC endpoints, endpoint policies, and security groups
* Experience with container security and software supply chain controls, including SBOMs, image signing, vulnerability scanning, and Amazon ECR
* Experience with GuardDuty, Security Hub, and AWS Config
* Strong understanding of data classification, authorization, entitlement design, and least-privilege principles
* Ability to conduct practical threat modeling and translate identified risks into implementable technical controls
* Experience operating in a financial services or similarly highly regulated environment

Strong hands-on knowledge of AWS security and IAM, including:
* IAM roles and policies
* Trust policies
* Permission boundaries
* Service Control Policies
* STS/AssumeRole
* Cross-account authorization

Strong understanding of modern authentication and authorization, including:
* OAuth 2.0
* OpenID Connect
* JWT
* Token exchange
* Delegated/on-behalf-of authentication

Preferred:
* Experience securing cloud-native data or AI platforms
* Familiarity with CI/CD security and automated security controls
* Understanding of infrastructure-as-code security and cloud configuration management
* Experience working with enterprise-scale AWS environments involving multiple accounts and centralized security governance
* Familiarity with financial-services security and regulatory expectations and frameworks such as NIST CSF, NIST 800-53, CIS Benchmarks, SOC 2, PCI DSS, or FFIEC guidance, where applicable
* Experience translating security policies into technical guardrails and automated controls

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.

By clicking ?Apply Today? you agree to receive calls, AI-generated calls, text messages or emails from Kforce and its affiliates, and service providers. Note that if you choose to communicate with Kforce via text messaging the frequency may vary, and message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You will always have the right to cease communicating via text by using key words such as STOP.