AWS Cloud Security Engineer

Booz Allen Hamilton•San Diego, CA

5d•$69,300 - $158,000•Remote

About The Position

Organizations are expanding their use of AWS, but securing a large cloud environment requires more than deploying individual security tools. As an AWS cloud security engineer, you know how to assess how services are being used, establish secure configuration standards, build preventive guardrails, automate controls, and help engineering teams operate cloud environments consistently and securely. As an AWS Cloud Security Engineer on our team, you’ll support a hands-on AWS cloud security assessment and engineering program for a large enterprise environment. You’ll help review AWS Organizations, accounts, landing zones, identity, networking, security services, workloads, policies, Infrastructure as Code, and existing security tooling to identify gaps and opportunities to strengthen the client’s cloud security posture. You’ll work with AWS Organizations, IAM, IAM Identity Center, Service Control Policies, VPC networking, CloudTrail, Config, GuardDuty, Security Hub, KMS, Systems Manager, and other AWS-native services. You’ll assist in establishing minimum secure configuration baselines for AWS services, developing reusable Terraform and Infrastructure as Code, creating security policies and guardrails, evaluating existing cloud security tooling, and developing implementation-ready technical documentation. This is an opportunity to combine practical AWS engineering with cloud security architecture, automation, and client delivery. You’ll work alongside experienced cloud architects and security engineers while collaborating directly with cloud platform teams, security stakeholders, application owners, governance teams, and client leadership. You’ll support work that includes AWS security assessments, landing zone reviews, identity and access management, network security, Secure copy protocol (SCP) development, secure service baselines, Infrastructure as Code, security automation, application architecture reviews, tooling optimization, and cloud governance. Your ability to translate technical requirements into scalable, repeatable engineering solutions will help clients strengthen cloud security while enabling continued adoption of AWS.

Requirements

3+ years of experience with AWS cloud engineering, cloud security, infrastructure engineering, DevSecOps, site reliability engineering, or enterprise cloud delivery
Experience with AWS Organizations, organizational units, multi-account environments, IAM, roles, policies, Service Control Policies, or cross-account access
Experience with AWS networking, including VPCs, subnets, security groups, routing, Transit Gateway, private connectivity, DNS, load balancing, or ingress and egress controls
Experience with AWS security and monitoring services, including CloudTrail, AWS Config, GuardDuty, Security Hub, KMS, IAM Access Analyzer, CloudWatch, Systems Manager, or AWS Inspector
Experience developing or reviewing Terraform, AWS CloudFormation, or Infrastructure as Code used to deploy and manage AWS resources
Experience in assisting with developing cloud security standards, secure configuration baselines, technical guardrails, policies, or reusable security patterns
Experience with scripting or automation using Python, Bash, PowerShell, AWS CLI, SDKs, APIs, or engineering tools
Experience assessing technical environments, identifying security or architecture gaps, and translating findings into practical recommendations, implementation steps, or technical documentation
Ability to work directly with cloud engineers, architects, cybersecurity teams, application teams, governance stakeholders, and client leadership
Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Engineering, or Information Systems

Nice To Haves

Experience with AWS IAM Identity Center, SAML, OIDC, permission sets, privileged access, enterprise federation, or identity governance
Experience designing, reviewing, or supporting AWS landing zones, AWS Control Tower, account vending, centralized logging, shared services, or enterprise AWS platform architectures
Experience in assisting with developing AWS Service Control Policies, IAM policies, resource policies, permission boundaries, or preventive cloud security controls
Experience developing secure baselines and Infrastructure as Code for multiple AWS services in a large enterprise environment
Experience with cloud security platforms such as Wiz, Prisma Cloud, Orca Security, Lacework, or other Cloud Security Posture Management (CSPM) or Cloud-Native Application Protection Platform (CNAPP) technologies
Experience with integrating security requirements into CI/CD pipelines, Git workflows, DevSecOps processes, automated testing, or policy-as-code
Experience with security frameworks or standards such as NIST, CIS Benchmarks, ISO 27001, FedRAMP, or cloud security control frameworks
Experience reviewing application architectures, dependencies, and infrastructure components and identifying opportunities to use AWS-native services or cloud-native design patterns
Experience supporting large enterprise, Fortune 500, regulated, or multi-account cloud environments
Knowledge of Microsoft Azure or Google Cloud security

Responsibilities

Support a hands-on AWS cloud security assessment and engineering program for a large enterprise environment.
Review AWS Organizations, accounts, landing zones, identity, networking, security services, workloads, policies, Infrastructure as Code, and existing security tooling to identify gaps and opportunities to strengthen the client’s cloud security posture.
Assist in establishing minimum secure configuration baselines for AWS services.
Develop reusable Terraform and Infrastructure as Code.
Create security policies and guardrails.
Evaluate existing cloud security tooling.
Develop implementation-ready technical documentation.
Collaborate directly with cloud platform teams, security stakeholders, application owners, governance teams, and client leadership.
Support work that includes AWS security assessments, landing zone reviews, identity and access management, network security, Secure copy protocol (SCP) development, secure service baselines, Infrastructure as Code, security automation, application architecture reviews, tooling optimization, and cloud governance.
Translate technical requirements into scalable, repeatable engineering solutions.