Cloud Security Guardrails Engineer

Guardrails are the difference between a cloud environment that is compliant on paper and one that stays compliant on a Tuesday afternoon when an engineer is in a hurry. This seat writes those guardrails. You will author the policies that make the insecure action impossible rather than merely discouraged, and you will do it in a multi-account AWS organization where a single misdrafted statement can lock out a mission team.

The role is deliberately narrow and deeply technical. It is not an audit seat and it is not a documentation seat; a separate Security Authorization Lead owns the ATO package. What you own is the enforcement layer: service control policies, resource control policies, permission boundaries, config rules, key policies, and the automated remediation that closes findings without a human ticket.

WHAT YOU WILL DO

• Author the policy layer. Write, test, and version Service Control Policies and Resource Control Policies across the AWS Organizations structure, including region locks and data perimeter controls.
• Design permission boundaries. Build IAM permission boundaries and delegated administration models that let account owners move quickly inside a fenced blast radius.
• Codify detection. Develop AWS Config rules and conformance packs mapped to the control set, and wire automated remediation through Systems Manager or Lambda.
• Own the key material. Design KMS customer-managed key policies, rotation, grants, and cross-account access patterns that hold up under review.
• Run Security Hub as a working queue. Tune standards and findings, suppress the noise with justification, and drive real remediation instead of dashboard maintenance.
• Prove the guardrails work. Build test cases that attempt the prohibited action and confirm the policy denies it, then keep those tests running as the environment changes.
• Partner with the authorization team. Supply the technical evidence, artifacts, and control narratives that support the accreditation package without owning the package yourself., The seat is remote or hybrid within the continental United States, depending on the supported program. Some engagements require periodic on-site presence for accreditation activities. Cleared engineers with this skill set are placed from D9Tech’s bench. Applying while you are still under contract elsewhere is normal and expected; we track availability rather than assume it.

• Active Secret clearance or higher.
• U.S. citizenship.
• Hands-on experience in a multi-account AWS Organizations environment, including OU design and account structure.
• Demonstrated authorship of Service Control Policies, and familiarity with Resource Control Policies and data perimeter patterns.
• Deep IAM fluency: roles, trust policies, condition keys, and permission boundaries.
• Production experience with AWS Config rules, conformance packs, and automated remediation.
• Working knowledge of KMS key policies and encryption controls.
• Infrastructure as code proficiency, since guardrails are deployed and versioned as code rather than clicked into a console., * AWS GovCloud, IL4, IL5, or classified region experience.
• Landing Zone Accelerator or Control Tower deployment experience.
• Familiarity with NIST SP 800-53 and the DoD Cloud Computing Security Requirements Guide.
• AWS Certified Security Specialty, or Solutions Architect Associate or Professional.
• CompTIA Security+ (Sec+ CE) or an equivalent DoD 8140 baseline certification.
• Scripting depth in Python for custom rules, remediation, and policy testing.

D9Tech Resources is a Service-Disabled Veteran-Owned Small Business and SBA 8(a) participant delivering cleared cloud, cybersecurity, network, data, and AI engineering to Federal and Department of Defense customers. Bench engineers are interviewed, verified, and kept ready, so that when a billet opens we place a known quantity instead of starting a search.