Aws Cloud Security Engineer

Job Role: Aws Cloud Security Engineer

Location: Boston, MA, Arlington, VA, Atlanta, GA,:Austin, TX, Chicago, IL, Cleveland, OH:

Experience: 10 Years

Skills:

This Senior Consultant role modernizes legacy workloads into cloud-native, resilient and observable AWS platforms. The consultant is expected to operate as an embedded AWS SME, provide hands-on implementation support, and create audit-ready technical documentation aligned to regulated Financial Services delivery expectations.

·         Multi-Account Governance (WS-2): Design AWS Organizations landing zone with OU structure, Service Control Policies (SCPs), centralized logging (CloudTrail, VPC Flow Logs, AWS Config), and automated account vending for Security Lab foundation

·         Isolated Recovery Environment (WS-3): Architect IRE account with WORM vault locking (S3 Object Lock/Backup Vault Lock), cross-account/cross-region backup (3-2-1 strategy), AWS KMS CMKs, CyberArk break-glass integration, Amazon Macie data classification, AWS Network Firewall, Transit Gateway route isolation, and recovery orchestration

·         Clean Room Forensics: Design forensic investigation environment with network isolation, immutable evidence storage, and controlled access patterns

·         Security Lab Infrastructure: Establish Amazon EKS baseline and lab environment for testing security capabilities, threat simulation, and vulnerability assessments

·         Compliance & Audit: Design AWS Backup Audit Manager compliance framework, Route 53 DNS isolation, and hardened compute baselines (AMI/container hardening)

·         Documentation & Implementation: Author IRE & Clean Room Architecture & Design Document, Security Lab Architecture Document, lab operations guide, and account vending admin procedures

·         Security Agent Infrastructure (WS-1): Design and support AWS Security Agent cloud infrastructure implementation

Secrets Management: Implement AWS Secrets Manager/Parameter Store integration with CyberArk for break-glass scenarios

Key Deliverables:

·         Multi-Account Landing Zone Architecture with OU/SCP design

·         IRE & Clean Room Architecture & Design Document

·         Security Lab Architecture Document

·         Backup Audit Manager compliance framework

·         Hardened compute baselines (AMIs, EKS node configurations)

·         Account vending automation and admin procedures

Recovery orchestration runbooks

Governance & Multi-Account Architecture:

·        AWS Organizations: OU structure design, SCP policies, consolidated billing, cross-account IAM strategies

·        AWS Control Tower: Landing zone automation, guardrails, Account Factory customization

·        AWS Service Catalog: Automated account vending, standardized resource provisioning

·        AWS Resource Access Manager (RAM): Cross-account resource sharing for Transit Gateway, Route 53 Resolver

Security & Compliance:

·        AWS IAM: Advanced policies, permission boundaries, IRSA (IAM Roles for Service Accounts), cross-account roles, break-glass access patterns

·        AWS KMS: Customer Managed Keys (CMKs), key policies, cross-account/cross-region key grants, envelope encryption

·        AWS Secrets Manager: Secret rotation, CyberArk integration, cross-account secret access

·        Amazon Macie: Sensitive data discovery, S3 bucket classification, compliance reporting

·        AWS Security Hub: Centralized security findings, compliance standards (CIS, PCI-DSS)

·        AWS GuardDuty: Threat detection, malware protection, runtime monitoring

·        AWS Network Firewall: Stateful/stateless rules, intrusion prevention, domain filtering

·        AWS WAF: Web application protection, managed rule groups

Backup & Disaster Recovery:

·        AWS Backup: Centralized backup management, WORM vault locking (Vault Lock), cross-account/cross-region backup, 3-2-1 backup strategy

·        AWS Backup Audit Manager: Compliance framework design, backup policy enforcement, audit reporting

·        Amazon S3: Object Lock (WORM compliance), versioning, cross-region replication, Glacier Vault Lock

·        AWS Elastic Disaster Recovery (DRS): Continuous replication, recovery orchestration, failover testing

Logging & Monitoring:

·        AWS CloudTrail: Multi-account trail design, log file validation, S3/CloudWatch Logs integration, event history analysis

·        Amazon CloudWatch: Centralized logging, log aggregation, metric filters, alarms, dashboards

·        VPC Flow Logs: Network traffic analysis, security group validation, threat detection

·        AWS Config: Configuration compliance, resource inventory, change tracking, conformance packs

Networking & Isolation:

·        Amazon VPC: Advanced networking, security groups, NACLs, VPC peering, PrivateLink

·        AWS Transit Gateway: Hub-and-spoke architecture, route table isolation, network segmentation

·        Amazon Route 53: DNS isolation, private hosted zones, DNSSEC, resolver rules

·        AWS PrivateLink: Service endpoint isolation, cross-account connectivity without internet exposure

Container & Compute Security:

·        Amazon EKS: Cluster hardening, pod security policies/standards, IRSA, network policies, secrets encryption, runtime security

·        Amazon ECR: Image scanning, vulnerability assessment, immutable tags, lifecycle policies

·        AWS Systems Manager: Patch Manager, Session Manager (bastion replacement), Parameter Store, hardened AMI automation

·        Amazon EC2: Hardened AMI creation, IMDSv2 enforcement, instance metadata security, EBS encryption

Forensics & Incident Response:

·        Amazon Detective: Security investigation, graph-based analysis, threat hunting

·        AWS Step Functions: Recovery orchestration workflows, automated incident response

·        Amazon EventBridge: Event-driven security automation, cross-account event routing

·        AWS Lambda: Automated remediation, forensic data collection, snapshot automation

Infrastructure as Code & Automation:

·        AWS CloudFormation: StackSets for multi-account deployments, nested stacks, drift detection

·        AWS CDK: Programmatic infrastructure definition, construct libraries for security patterns

·        AWS Service Catalog: Self-service account vending, compliance-approved resource templates

Cost Optimization & Governance:

·        AWS Cost Explorer: Cost allocation tags, backup storage optimization

·        AWS Budgets: Cost alerts, anomaly detection

·         AWS Trusted Advisor: Security and cost optimization recommendations

·        Large regulated financial-services delivery with formal change-control, audit and risk governance

·        Operational resilience expectations including RTO/RPO, multi-region DR and evidence for audit review

·        Awareness of applicable controls and regulations such as DORA, NIST CSF 2.0, PCI DSS, SEC cyber rules, RegSCI and SIFMU/FMI expectations where relevant

·        Ability to create Tech Risk-ready documentation including ADRs, runbooks, design docs, threat models and validation evidence

·        Clear communication with client engineering, security, SRE, data and platform stakeholders as an embedded SME

·        AWS Certified Solutions Architect - Associate / Professional

·        AWS Certified Developer - Associate

·        AWS Certified DevOps Engineer - Professional preferred