Cloud Security Analyst

InvestCloud, Inc.•,

5d•$175,000 - $200,000

About The Position

InvestCloud is seeking a cloud security professional to design and help build the AWS environment that runs its SaaS platform. The role works closely with development and infrastructure engineers and owns security across identity, networks, containers, storage, encryption, and logging. The position helps protect financial services customers, including banks and wealth managers, by establishing secure infrastructure and enabling teams to build securely. The successful candidate will design AWS security architecture, establish secure baselines, create logging and monitoring, review cloud designs and changes, and build guardrails and automated checks. The role also partners with the Application Security Architect to use Wiz to identify and remediate cloud risks, documents reference architectures and patterns, and mentors engineers. In the first year, success means new AWS services are secure from day one, engineering teams involve security early because it helps their work, the AWS environment follows a written secure standard with drift quickly detected and corrected, and the company can demonstrate infrastructure security to customers, auditors, and regulators. InvestCloud describes its security team as spanning the United States, Romania, and India. Its work supports platforms relied on by banks and wealth managers. The company is a global wealth technology provider serving wealth and asset managers, wirehouses, banks, RIAs, and insurers, among other clients.

Requirements

Typically eight or more years of experience in security engineering or architecture, including at least five years focused on hands-on AWS security in multi-account environments.
Expert knowledge of AWS identity, including IAM, AWS Organizations, service control policies, and IAM Identity Center.
Expert knowledge of AWS networking, including VPC design, security groups, AWS Network Firewall, and AWS WAF.
Expert knowledge of encryption, including KMS, CloudHSM, and certificate management.
Strong container security experience with Amazon EKS or ECS, including image security, runtime protection, and least-privilege workload identity.
Experience designing security logging with CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and a central log platform.
Working command of cryptography, including selecting appropriate algorithms, rotating keys, and protecting secrets.
Infrastructure-as-code skills in Terraform or CloudFormation and ability to read and write code.
Experience securing a SaaS platform for regulated customers; financial services experience is identified as ideal.
Ability to explain complex risk in plain language to engineers and executives.
Self-starter who identifies important work and completes it independently.
Commitment to ongoing learning and building expertise.
Ability to share knowledge respectfully and help colleagues improve.

Nice To Haves

Microsoft Azure or Microsoft 365 security experience.
Hands-on experience with Wiz or a similar cloud security platform.
AWS Certified Security Specialty certification, or equivalent depth of experience.
Experience securing SaaS platforms for regulated customers in financial services.

Responsibilities

Design the security architecture for the AWS environment and participate in design and build activities alongside development and infrastructure teams.
Set and maintain secure baselines for identity and access, network and firewall controls, containers and Kubernetes, storage, encryption, key management, and cryptography.
Design security logging and monitoring to enable visibility into and investigation of activity across AWS accounts and workloads.
Review cloud designs and changes and provide practical guidance that keeps projects moving.
Build guardrails and automated checks to prevent insecure configurations from reaching production.
Partner with the Application Security Architect to use Wiz to identify and remediate cloud risk from code to runtime.
Write reference architectures and patterns that enable teams to build securely without waiting on security.
Mentor engineers across the company.
Help ensure new AWS services are secure from day one and that deviations from written secure standards are detected and corrected quickly.
Help demonstrate secure infrastructure to customers, auditors, and regulators.

Benefits

Medical/Rx insurance
Dental insurance
Vision insurance
Disability insurance
Life and AD&D insurance
Flexible Savings Account (FSA)
Health Savings Account (HSA)
Employee Assistance Plan (EAP)
Health advocacy
Voluntary ancillary plans, including accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance
401(k) retirement savings plan with company match
Paid time off