{"id":716859,"url":"https://alion.io/job/2026-on-energy-storage-inc-aws-cloud-security-engineer","title":"AWS Cloud Security Engineer","company":{"id":2116613,"name":"ON.energy","domain":"on.energy","url":"https://alion.io/company/on-energy","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":78,"open_postings":9,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":69,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Argentina"],"countries":["AR"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":46000,"max_usd":107000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2225},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CloudFormation","optional":false},{"name":"DNS","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Terraform","optional":false},{"name":"VPN","optional":false},{"name":"Datadog","optional":true},{"name":"DNP3","optional":true},{"name":"Grafana","optional":true},{"name":"MQTT","optional":true},{"name":"OPC UA","optional":true},{"name":"SIEM","optional":true},{"name":"Wazuh","optional":true}],"status":"live","first_seen_at":"2026-08-26T17:37:29Z","employer_posted_date":"2026-09-10","last_verified_at":"2026-10-21T13:27:09Z","board_verified":true,"closed_at":null,"days_open":55,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":55},"description":"ON.energy is setting the standard for large load interconnection. ON’s patented AI UPS™ is a medium-voltage UPS that serves as a firewall, protecting the data center from the grid, and the grid from the data center. With multiple gigawatts currently under construction, we are enabling grid-safe data centers. \nKey Responsibilities \nThe multi-account security foundation. AWS Organizations structure, SCPs, guardrails, a security tooling account, centralized logging, and secure baselines - delivered as infrastructure as code, not console clicks.\nSecurity standards and review gates. You can mandate controls and block deploys that introduce unacceptable risk, through review gates on identity and network changes, a documented exception path, and a defined escalation route.\nAWS identity and access. IAM Identity Center as the single front door, federated with Entra ID in partnership with IT, who own Entra as the source of truth. Role and group model mapping job functions to permissions; joiner/mover/leaver; privileged and break-glass access; workload identity; recurring access reviews. Hands-on at first, progressively automated so it stops being manual work.\nCloud-to-site connectivity and segmentation - the defining part of this role. Every plant, BESS site, and remote asset that reaches our cloud does so over a path you design and defend: site-to-cloud VPN and private connectivity, hard segmentation between IT and OT zones, DMZ and broker patterns for site telemetry, certificate and device identity for field gateways, remote vendor access to sites, and strict control over what may initiate traffic in each direction. You own the cloud side of that boundary and share the path itself with the OT security owner.\nThreat detection, monitoring, and mitigation. You are expected to know how attacks actually run - credential and token abuse, cross-account privilege escalation, exposed control and management interfaces, lateral movement from a compromised site network into cloud, supply-chain and dependency compromise, ransomware staging - and to build the monitoring that catches them. GuardDuty, Security Hub, Detective, Inspector, Config, and CloudTrail tuned for real signal-to-noise, detections mapped to MITRE ATT&CK and ATT&CK for ICS, runbooks the wider team can execute, and the mitigations driven to done.\nVulnerability management. Scanning coverage across workloads, images, and dependencies; risk-based triage and prioritization; remediation SLAs and exception handling; posture reporting. You identify and prioritize; the AWS engineers remediate in the workloads they own.\nKey Requirements\n5+ years in cloud security, security-focused infrastructure, or cloud operations, with deep hands-on AWS.\nProduction experience in multi-account AWS environments.\nDemonstrable command of attacker techniques and the detections and mitigations that counter them - you can walk an intrusion path end to end and explain how you would catch it, contain it, and close it.\nHybrid and site-to-cloud network security: segmentation, VPN, private connectivity, firewalls, routing, DNS, CIDR and subnetting - securing connections between cloud and physical facilities.\nStrong AWS identity: roles, policies, permission sets, MFA, least privilege, access reviews; IAM Identity Center federated with an external IdP, ideally Microsoft Entra ID.\nAWS-native security services: GuardDuty, Detective, Security Hub, Inspector, Config, CloudTrail, KMS, WAF.\nInfrastructure as code - CDK, CloudFormation, or Terraform. You build controls, you don't click them.\nAdvanced English (B2-C1) for daily work with English-speaking teams and written security documentation.\nPreferred Qualifications\nSecurity experience in OT- or ICS-adjacent environments: IT/OT segmentation, Purdue-model zoning, secure remote access to field sites, and protocols such as Modbus, DNP3, OPC UA, or MQTT crossing into cloud.\nDetection engineering and SIEM work; threat modelling; incident response you have personally run.\nRegulated or compliance-driven environments where access control, monitoring, and audit evidence are held to an external standard.\nTurning scanner output and audit findings into prioritized, actionable work for engineers who do not report to you.\nTroubleshooting security, identity, networking, and infrastructure issues across cloud and hybrid environments.\nLanding zones, Control Tower, and security account patterns.\nIEC 62443 or NIST SP 800-82 familiarity.\nContainers and serverless workloads.\nEnergy, utilities, or other mission-critical environments.\nWazuh, Datadog, Grafana, or similar.\nSecurity documentation and ADRs.\nCertifications\nValued as a signal, not a substitute for experience: AWS Certified Security - Specialty; AWS Certified Advanced Networking - Specialty; AWS Certified Solutions Architect; GICSP or GIAC GRID; CISSP; CCSP; Microsoft Certified: Identity and Access Administrator Associate.\nFor US-based roles - What you’ll get:\nCompetitive salary + annual performance-based bonus eligibility\nMedical, dental, and vision insurance\n401(k) with company match\nPaid time off and company holidays \nFor Mexico-based roles - What you’ll get:\nCompetitive salary + annual performance bonus eligibility\nChristmas Bonus (Aguinaldo): 30 days\nMajor medical expenses and life insurance\nPaid time off and holidays (per local policy)\nFor all roles:\nProfessional development and growth opportunities\nOpportunity to grow with a mission-driven team shaping the future of clean energy\nEqual Opportunity: ON.energy is committed to equal employment opportunity and to maintaining a work environment free of harassment, discrimination, or retaliation.\nBenefits vary by role and location and are subject to change.\nAgency Notice: ON.energy does not accept unsolicited resumes from staffing agencies, search firms, or third-party recruiters. Resumes submitted without a fully executed Master Services Agreement (MSA) and a written request from an authorized member of our Talent Acquisition team will be considered the property of ON.energy. No placement fees or compensation will be paid for unsolicited candidate submissions.","description_format":"text","description_chars":6117,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":["Growth opportunities","Life insurance","Professional development","Vision insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","Energy Storage","Power Grid","Power Supplies & Power Electronics"],"lifecycle":[{"event":"open","at":"2026-09-11T06:14:18Z"}],"visa":[],"liveness":{"score":64,"band":"ok","label":"Likely open","p_open":1,"p_active":0.852,"p_room":0.75,"age_days":55,"expected_fill_days":69,"reasons":["conf:1","velocity","win:late"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/2026-on-energy-storage-inc-aws-cloud-security-engineer","json_url":"https://alion.io/job/2026-on-energy-storage-inc-aws-cloud-security-engineer.json","meta":{"generated_at":"2026-10-21T13:35:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19266,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2116613},"rest":"https://alion.io/mcp/rest/get_company?id=2116613"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2F2026-on-energy-storage-inc-aws-cloud-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2F2026-on-energy-storage-inc-aws-cloud-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2F2026-on-energy-storage-inc-aws-cloud-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/2026-on-energy-storage-inc-aws-cloud-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2F2026-on-energy-storage-inc-aws-cloud-security-engineer"}]}