Cloud Security Engineer

Key Responsibilities

1. Cloud Security Architecture & Design Controls

• Design and implement secure, scalable, and resilient AWS cloud architectures aligned with enterprise security standards and best practices.
• Define security controls for AWS environments, including account structures, landing zones, workload isolation, and security boundaries.
• Design and implement network segmentation using VPCs, subnets, security groups, Network ACLs, AWS Network Firewall, and other cloud-native security controls.
• Establish appropriate security controls for internet-facing, internal, and highly sensitive workloads.
• Design secure connectivity between AWS, on-premises data centers, and third-party environments.
• Implement encryption for data at rest and in transit using services and technologies such as AWS KMS, TLS/SSL, and certificate management.
• Conduct security architecture reviews for new cloud workloads, migrations, application modernization, and cloud transformation initiatives.
• Identify security risks in proposed architectures and provide practical recommendations to mitigate those risks.
• Develop and maintain cloud security reference architectures, security patterns, standards, and design guidelines.
• Ensure security controls are consistently applied across development, testing, and production environments.

2. Identity & Access Management (IAM)

• Design and maintain robust Identity and Access Management (IAM) controls based on the principles of least privilege and zero trust.
• Define and manage IAM roles, policies, permission boundaries, service roles, and cross-account access.
• Implement and enforce Multi-Factor Authentication (MFA) and strong authentication mechanisms.
• Establish appropriate access controls for employees, administrators, applications, workloads, and third-party users.
• Implement secure privileged-access mechanisms for administrative and high-risk accounts.
• Integrate AWS environments with enterprise Identity Providers and Single Sign-On (SSO) platforms.
• Regularly review IAM permissions to identify excessive, unused, or inappropriate access.
• Identify and remediate risks such as overly permissive IAM policies, exposed credentials, inactive accounts, and inappropriate privilege escalation paths.
• Establish processes for joiner, mover, and leaver access management.
• Support periodic access reviews and provide evidence for security and compliance audits.

3. Security Automation & DevSecOps

• Integrate security controls and automated security checks into CI/CD pipelines.
• Implement security testing across infrastructure, application, container, and cloud configurations.
• Use Infrastructure-as-Code (IaC) tools such as Terraform to consistently deploy and manage cloud security controls.
• Implement automated checks for infrastructure misconfigurations, insecure configurations, and policy violations before deployment.
• Introduce policy-as-code and automated compliance validation where appropriate.
• Automate remediation of common cloud security misconfigurations and security findings.
• Work closely with DevOps and engineering teams to embed DevSecOps practices into the software development lifecycle.
• Develop reusable Terraform modules, security templates, policies, and automation frameworks.
• Ensure security controls are repeatable, auditable, version-controlled, and integrated into automated deployment processes.
• Continuously improve the organization's security posture through automation and standardization.

Key Attributes

• Strong analytical and problem-solving skills.
• Ability to translate security requirements into practical cloud architectures and technical controls.
• Strong communication and stakeholder-management skills.
• Ability to work across architecture, engineering, DevOps, infrastructure, and security teams.
• Strong ownership of security risks and remediation.
• Ability to balance security, business requirements, operational considerations, and delivery timelines.