Senior Cloud Security Engineer

This is a fully remote position, open to applicants in Ukraine, +1 more country.

📋 Description

• Take full responsibility for the security of an AWS supply chain and shipment management platform from start to finish.

• Design and oversee a multi-account AWS Organizations structure featuring organization-wide CloudTrail and log archives, delegated GuardDuty, Security Hub, and Config, as well as service control policies.

• Implement threat detection measures and high-risk change notifications across all accounts and regions.

• Manage alert triage, serve on security on-call, and handle incident response duties.

• Direct Security Hub, Inspector, and SonarQube findings into ticketing systems, perform weekly reviews, and collaborate with DevOps to establish patch plans.

• Administer short-lived, role-based credentials for both personnel and automation processes.

• Conduct privileged access evaluations across IAM Identity Center and Keycloak while enhancing Keycloak security.

• Develop incident runbooks, conduct tabletop drills, and test backup restorations, including scenarios involving ransomware.

• Execute DNS filtering, manage secrets, ensure encryption during transit and at rest, and minimize the external attack surface.

• Oversee quarterly external penetration testing, respond to customer security questionnaires and audits, and participate in AWS partner evaluations.

• Review infrastructure and application modifications for security compliance and maintain up-to-date policies.

• Build and refine AI-assisted security triage agents, ensuring human oversight for every proposed action.

• Report directly to the CTO and collaborate with DevOps and development teams to remediate findings.

⛳️ Requirements

• A minimum of 6 years in security or infrastructure engineering, including at least 3 years of hands-on experience securing production AWS environments.

• Capacity to work independently: prioritize tasks, make decisions, and follow through to completion.

• Profound knowledge of AWS security, including IAM and Organizations (SCPs, Identity Center, cross-account roles), CloudTrail, GuardDuty, Security Hub, Config, Inspector, KMS, Secrets Manager, VPC, and network controls.

• Proficient in writing and reviewing production Terraform code.

• Experience with scripting in Python or Bash for automation and investigative purposes.

• Proven track record of leading real incidents from the initial alert through containment and post-mortem analysis.

• Familiarity with SSO, MFA, least privilege principles, and access review processes.

• Experience with Keycloak or another OIDC/SAML provider.

• Capability to produce evidence for SOC 2, ISO 27001, or similar standards, and to respond to enterprise customers' security inquiries.

• Ability to clearly communicate risk to both engineers and executives.

• Skill in facilitating fixes through collaboration with other teams without direct authority.

• Proficient in written English.

🏝️ Benefits

• Paid vacation days: 24 working days.

• Paid sick days: 15 working days.

• Opportunity to allocate up to 10% of working hours for self-education and personal development.

• BYOD program (Bring Your Own Device).