Job#: 3059286 Job Description: We are seeking a senior engineer who can also lead technically - designing, building, and shipping the cloud security controls platform that protects Vanguard's AWS (primary) and multi-cloud environments. You will write production-grade code and infrastructure-as-code to deliver preventive and detective controls - SCPs, permission boundaries, resource and identity policies, posture checks, and event-driven remediation - roll them out safely, own the standards for how they are built and shipped, and raise the engineering bar for the team around you. The ideal candidate pairs deep hands-on engineering with deep cloud expertise and technical leadership, and influences across teams without direct authority. They bring sound security instincts - reasoning about trust boundaries, least privilege, and blast radius. Deep expertise in our specific security and IAM policy frameworks is not required on day one; we are looking for the engineering strength and judgment to master them quickly.
The stack you'll work with:
Core - Hands-on day one
- AWS IAM - roles, policies, trust and resource-policy patterns, permission boundaries, SCPs.
- CloudFormation (JSON/YAML) - heavy, day to day: authoring, testing, and stage-rolling infrastructure and controls as code (Terraform where it fits).
- Python for production-grade tooling, policy-as-code (Rego/OPA), AWS CLI and SDKs (e.g. boto3).
- CI/CD pipelines (GitHub Actions, Bamboo, or similar) for building, testing, and shipping controls.
- Core AWS at org scale - Organizations, IAM Identity Center, and services such as Lambda, EventBridge, Step Functions, S3, API Gateway, and CloudWatch.
Nice to have - or you'll pick up fast
- Security-native AWS - Config, Secrets Manager, CloudTrail, Access Analyzer, and KMS.
- CSPM / cloud governance platforms (e.g. Wiz) and observability tooling (Splunk, Elastic, Grafana).
- Data skills (SQL and JSON, ETL, Tableau/Power BI).
- Multi-cloud exposure (Google Cloud Platform, Azure, OCI).
- PowerShell, PySpark, and AI-assisted tooling.
Core Responsibilities:
Technical Leadership
- Lead technical design reviews and own the standards for how controls are built, tested, and shipped - raising the bar on code quality, systems thinking, and operational readiness.
- Train, mentor, and coach engineers and new crew on technology standards, best practices, and frameworks; troubleshoot and resolve the most complex issues elevated from staff.
- Influence engineering patterns and best practices across teams - driving technical direction beyond your immediate team, without direct authority.
Solution Design & Delivery
- Design enterprise-scale solutions (policy pipelines, event-driven remediation, API contracts) that other engineers build on - designing for auditability, fault tolerance, and graceful degradation when upstream systems change.
- Evaluate and select the tooling, frameworks, and integration patterns the broader team adopts - owning the technical standards for how controls connect to enterprise infrastructure (CI/CD, identity providers, logging/observability, CMDB/ITSM).
- Move fluidly between design and hands-on build; stay close to the code.
Automation & Infrastructure as Code
- Build preventive and detective controls as code - author, test, and stage-roll guardrails so they land safely in production, using infrastructure-as-code (CloudFormation and/or Terraform) and policy-as-code (Rego/OPA).
- Embed controls into CI/CD pipelines and runtime configuration checks; own the build-break vs. detect-and-alert decision for each control.
- Automate posture checks, drift detection, and event-driven remediation; identify efficiency gains through tooling and emerging technology (including AI/ML where appropriate).
Security Engineering & Strategy
- Engineer preventive controls (SCPs, RCPs, permission boundaries, resource/identity policies, and pipeline/CI-CD guardrails) and detective controls (posture checks, drift detection, event-driven remediation) that operate at org scale.
- Operationalize CSPM/CNAPP findings (e.g. Wiz) into enforceable, automated controls.
- Translate enterprise security strategy, audit requirements, and risk priorities into well-defined technical work, and measure control coverage and effectiveness.
- Support privileged access controls and cloud account governance; contribute to audit responses and remediation, an on-call rotation, and special projects as needed.
Qualifications:
- Minimum of seven years related work experience, with four or more years in cloud or security engineering preferred.
- Strong hands-on engineering - writes and ships production-grade code (Python or equivalent - production-grade, not just scripting) and heavy hands-on infrastructure-as-code, with CloudFormation day to day (Terraform a plus).
- Deep cloud expertise - hands-on experience across at least one of AWS, Google Cloud Platform, or Azure (AWS strongly preferred), at the level of org-wide account structures, landing zones, and cross-account security patterns at scale.
- Technical leadership & influence - a track record of leading complex technical delivery, setting standards, mentoring engineers, and influencing technical direction across teams without direct authority.
- Security judgment - reasons about trust boundaries, least privilege, and blast radius; can threat-model what goes wrong when access is too broad.
- Familiarity with AWS IAM policy mechanics - inline, customer-managed, permission boundaries, SCPs, RCPs, and resource/identity policies - is a plus; depth here is learnable on the job.
- Experience working directly with engineering teams on policy-as-code, CI/CD integrations, code repositories and pipelines (GitHub or similar), and cloud security tooling.
- Experience operating in regulated or audit-driven environments.
- Relevant certification (e.g. AWS Security Specialty or a Professional-level AWS certification) is a plus, not required.
- Undergraduate degree in a related field or the equivalent combination of training and experience.
Everforth Apex is a world-class IT services company that serves thousands of clients across the globe. When you join Everforth Apex, you become part of a team that values innovation, collaboration, and continuous learning. We offer quality career resources, training, certifications, development opportunities, and a comprehensive benefits package. Our commitment to excellence is reflected in many awards, including ClearlyRateds Best of Staffing in Talent Satisfaction in the United States and Great Place to Work in the United Kingdom and Mexico.
Everforth Apex uses a virtual recruiter as part of the application process. Click for more details. By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Everforth Apex and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at
Everforth Apex Benefits Overview: Everforth Apex offers a range of supplemental benefits, including medical, dental, vision, life, disability, and other insurance plans that offer an optional layer of financial protection. We offer an ESPP (employee stock purchase program) and a 401K program which allows you to contribute typically within 30 days of starting, with a company match after 12 months of tenure. Everforth Apex also offers a HSA (Health Savings Account on the HDHP plan), a SupportLinc Employee Assistance Program (EAP) with up to 8 free counseling sessions, a corporate discount savings program and other discounts. In terms of professional development, Everforth Apex hosts an on-demand training program, provides access to certification prep and a library of technical and leadership courses/books/seminars once you have 6+ months of tenure, and certification discounts and other perks to associations that include CompTIA and IIBA. Everforth Apex has a dedicated customer service team for our Consultants that can address questions around benefits and other resources, as well as a certified Career Coach. You can access a full list of our benefits, programs, support teams and resources within our 'Welcome Packet' as well, which an Everforth Apex team member can provide.
Everforth Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Everforth Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law.
If you require an accommodation under the Americans with Disabilities Act to participate in an interview with a virtual recruiter or to use our website for a search or application, please contact our Benefits Department at or . Please note that this contact information is strictly to be used for medical ADA accommodations and that no other inquiries will be answered.
UnitedHealthcare creates and publishes the Transparency in Coverage Machine-Readable Files on behalf of Everforth Apex Systems.
