Cloud Security Engineer

Key Responsibilities 1. Cloud Security Architecture & Design Controls Design and implement secure, scalable, and resilient AWS cloud architectures aligned with enterprise security standards and best practices. Define security controls for AWS environments, including account structures, landing zones, workload isolation, and security boundaries. Design and implement network segmentation using VPCs, subnets, security groups, Network ACLs, AWS Network Firewall, and other cloud-native security controls. Establish appropriate security controls for internet-facing, internal, and highly sensitive workloads. Design secure connectivity between AWS, on-premises data centers, and third-party environments. Implement encryption for data at rest and in transit using services and technologies such as AWS KMS, TLS/SSL, and certificate management. Conduct security architecture reviews for new cloud workloads, migrations, application modernization, and cloud transformation initiatives. Identify security risks in proposed architectures and provide practical recommendations to mitigate those risks. Develop and maintain cloud security reference architectures, security patterns, standards, and design guidelines . Ensure security controls are consistently applied across development, testing, and production environments. 2. Identity & Access Management (IAM) Design and maintain robust Identity and Access Management (IAM) controls based on the principles of least privilege and zero trust . Define and manage IAM roles, policies, permission boundaries, service roles, and cross-account access. Implement and enforce Multi-Factor Authentication (MFA) and strong authentication mechanisms. Establish appropriate access controls for employees, administrators, applications, workloads, and third-party users. Implement secure privileged-access mechanisms for administrative and high-risk accounts. Integrate AWS environments with enterprise Identity Providers and Single Sign-On (SSO) platforms. Regularly review IAM permissions to identify excessive, unused, or inappropriate access. Identify and remediate risks such as overly permissive IAM policies, exposed credentials, inactive accounts, and inappropriate privilege escalation paths. Establish processes for joiner, mover, and leaver access management . Support periodic access reviews and provide evidence for security and compliance audits. 3. Security Automation & DevSecOps Integrate security controls and automated security checks into CI/CD pipelines . Implement security testing across infrastructure, application, container, and cloud configurations. Use Infrastructure-as-Code (IaC) tools such as Terraform to consistently deploy and manage cloud security controls. Implement automated checks for infrastructure misconfigurations, insecure configurations, and policy violations before deployment. Introduce policy-as-code and automated compliance validation where appropriate. Automate remediation of common cloud security misconfigurations and security findings. Work closely with DevOps and engineering teams to embed DevSecOps practices into the software development lifecycle. Develop reusable Terraform modules, security templates, policies, and automation frameworks. Ensure security controls are repeatable, auditable, version-controlled, and integrated into automated deployment processes. Continuously improve the organization's security posture through automation and standardization. Key Attributes Strong analytical and problem-solving skills. Ability to translate security requirements into practical cloud architectures and technical controls. Strong communication and stakeholder-management skills. Ability to work across architecture, engineering, DevOps, infrastructure, and security teams. Strong ownership of security risks and remediation. Ability to balance security, business requirements, operational considerations, and delivery timelines.