DevSecOps Engineer – AWS, Terraform, Security Compliance

This is a fully remote position, open to applicants in Canada.

📋 Description

• Oversee and maintain AWS infrastructure and environments

• Utilize Terraform/IaC extensively for infrastructure provisioning, migrations, and deployments

• Administer AWS access, permissions, security groups, and infrastructure controls

• Facilitate production deployments and infrastructure modifications while ensuring segregation of duties

• Diagnose infrastructure problems and provide production support for live applications

• Assist with client onboarding, including configuring environments and securely transferring data to AWS

• Keep AWS infrastructure, asset, security, and access documentation up to date

• Monitor production and security environments, addressing any issues or security concerns

• Collaborate with development and engineering teams while distinguishing between development and production access

• Manage access for new employees, terminated staff, and current users

• Perform periodic access reviews and uphold least-privilege access principles

• Aid in endpoint/laptop security management through Scalefusion

• Monitor and uphold security posture utilizing tools like SecurityScorecard

• Assist with SOC 2 compliance activities, annual audits, evidence gathering, and auditor inquiries

• Evaluate and suggest updates to IT security, access control, disaster recovery, and change control policies

• Review and refresh security awareness training materials, conducting annual training sessions

• Conduct vulnerability testing approximately bi-annually using AppCheck and assist in remediation efforts

• Participate in and take responsibility for specified components of Disaster Recovery tests

• Ensure DR documentation is precise, complete, and up-to-date

• Provide security awareness and policy training for new hires

• Facilitate secure onboarding, access provisioning, and employee offboarding processes

• Comprehend, document, and maintain the AWS SageMaker environment

• Manage assigned SageMaker infrastructure and operational tasks

⛳️ Requirements

• Extensive hands-on experience with AWS infrastructure and cloud environments

• Proficient in Terraform and Infrastructure as Code

• Experience in managing AWS IAM, permissions, security groups, and access controls

• Background in supporting production environments and live applications

• Strong grasp of DevSecOps principles and practices

• Knowledge of cloud security and infrastructure security

• Familiarity with monitoring, troubleshooting, and incident response

• Experience with infrastructure migrations and deployments

• Proficient in access management and user lifecycle management

• Experience working with security/compliance controls within a production setting

• Understanding of SOC 2 requirements and audit evidence processes

• Experience in Disaster Recovery testing and documentation

• Familiarity with vulnerability assessment/testing tools

• Experience in environments serving financial institutions, banks, or other security-sensitive clients is highly desirable

• Experience supporting SOC 2 Type II environments

• Background in financial services, banking, fintech, or other regulated sectors

• AWS certifications such as AWS Solutions Architect or AWS Security Specialty, or equivalent experience

• Terraform certification or strong demonstrable experience with Terraform

• Experience in managing machine learning/cloud environments, particularly SageMaker

• Familiarity with security and compliance tools such as AppCheck, SecurityScorecard, and Scalefusion

• Previous experience in a part-time DevSecOps or managed-services role

• Ability to operate independently with minimal day-to-day supervision

• Strong focus on security, documentation, and compliance requirements

• Effective communication skills with both technical and non-technical stakeholders

🏝️ Benefits

• Part-time workload averaging approximately 20 hours per week

• Additional support opportunities during SOC 2 audit preparation, evidence collection, DR testing, and other compliance periods