AWS Cloud Security Engineer
About The Position
Vertical Relevance is seeking a full-time AWS Cloud Security Engineer in the New York Metro area, with a hybrid work arrangement. The role supports customer engagements and a large-scale AWS governance and security transformation initiative, with a focus on implementing Service Control Policies (SCPs) and Resource Control Policies (RCPs) across AWS Organizations using Terraform and Control Tower AFT. The engineer will plan, build, and deploy software systems and automated security and compliance solutions, including writing well-constructed, testable code. The position requires professional experience architecting or operating automated Security and Compliance or DevSecOps solutions on AWS. The engineer will work directly with customers to provide technical and strategic guidance on cloud adoption, design and implement cloud security solutions, build customer trust as a technical resource, and turn customer needs into measurable results. The role also contributes technical content, reference architectures, automation tools, white papers, technical briefs, case studies, and blog posts. Work includes building self-service AWS account, security analytics, and compliance frameworks; authoring policies and runbooks; and developing repeatable automation and delivery pipelines. Candidates must be legally authorized to work in the United States without current or future employer sponsorship.
Requirements
- Hands-on experience authoring AWS SCPs and RCPs.
- Expertise in Terraform and Infrastructure as Code.
- Experience with AWS Organizations and multi-account governance.
- Experience with IAM Access Analyzer and IAM policy evaluation.
- Experience with VPC endpoint, Amazon S3, and AWS KMS policies.
- AWS Certified Security - Specialty certification.
- Experience with AWS Control Tower AFT.
- Experience authoring runbooks and conducting knowledge transfer.
- Customer-facing experience in software or technology.
- Ability to code with Python.
- Legally authorized to work in the United States without current or future employer sponsorship.
Nice To Haves
- Familiarity with Java and Bash.
- Experience with Jenkins, GitLab, Terraform, Vault, Git, Splunk, OWASP, Trend Micro, Palo Alto, Fortify, Twistlock, or Aqua Security.
- Familiarity with AWS CloudFormation, AWS CLI, or AWS CDK.
- Familiarity with AWS services including S3; Lambda, EC2, EKS, ECS, and ECR; VPC, Route 53, API Gateway, and Direct Connect; CodePipeline, CodeBuild, CodeCommit, and CodeDeploy; Control Tower, Organizations, CloudWatch, Auto Scaling, Config, CloudTrail, Service Catalog, and Systems Manager; and IAM, Inspector, KMS, Secrets Manager, Security Hub, Detective, GuardDuty, Macie, HSM, Certificate Manager, WAF & Shield, and Firewall Manager.
- Familiarity with AWS Landing Zone.
Responsibilities
- Help customers plan and progress their cloud adoption journeys by providing technical and strategic guidance.
- Consult, plan, design, and implement cloud security solutions for customers.
- Design and automate security and compliance solutions.
- Author SCP and RCP policy rule sets in Terraform and deploy policies through Control Tower AFT pipelines.
- Test policies and perform blast-radius analysis in sandbox environments, then deploy policies from Sandbox OU to NCZ and DPZ/Critical Zone.
- Build VPC endpoint, S3, and KMS resource-based policies.
- Develop runbooks and conduct knowledge transfer.
- Create self-service account frameworks, including organizational hierarchy designs, configuration templates, referenceable playbooks, code examples, and account setup runbooks.
- Develop automated continuous delivery pipeline frameworks to establish AWS accounts with configured, tested infrastructure in a repeatable, reliable, and secure manner.
- Develop Service Control Policies and account baselines aligned with customer security and compliance requirements.
- Create security threat analytics and dashboard solutions that gather, transform, and interpret AWS security event data.
- Select and define security requirements and determine how services such as Macie, GuardDuty, Inspector, and Security Hub, or alternative products, can be used.
- Codify provisioning of security analytics and reporting workflows, including centralized Security Hub, GuardDuty, Macie, AWS Config, Inspector, CloudTrail, and VPC Flow Logs implementations.
- Create self-service compliance frameworks, including Policy-as-Code controls, policy definitions, logical tests, execution frameworks, playbooks, runbooks, reports, and supporting sample code.
- Develop high-quality technical content, including automation tools, reference architectures, white papers, technical briefs, and implementation guidance.
- Share customer needs, feedback, and implementation challenges with technology roadmaps and recommend new or enhanced offerings.
- Support internal and external brand development by collaborating with Marketing and Alliances on blog posts and internal case studies.
- Innovate on behalf of customers and translate ideas into action with measurable results.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
