Security Engineer (App Dev)- onsite

oDeep IAM fluency: least-privilege policy design, roles vs. users, permission boundaries, cross-account trust, and spotting over-privileged automation identities oHands-on with the AWS security stack: GuardDuty, Security Hub, CloudTrail, Config, Inspector, KMS, Secrets Manager, VPC/network controls oUnderstands the shared responsibility model and where the application s exposure actually sits (S3 policies, security groups, public endpoints, etc.)

Automation and infrastructure-as-code oCan read and review Terraform/CloudFormation/CDK/etc, and knows how to put security checks into the pipeline (tfsec, Checkov, policy-as-code like OPA) oComfortable auditing Lambda, Step Functions, EventBridge, and scheduled jobs for insecure defaults, secret sprawl, and excessive permissions oTreats CI/CD as an attack surface: pipeline credentials, OIDC federation, artifact integrity, supply-chain risk

Secure engineering oCan write production-quality code (Python, Go, or similar) and can build security tooling oExperience with threat modeling for event-driven and service-to-service architectures, including non-human identities and machine-to-machine auth oKnows application security basics: OWASP, auth/session handling, input validation, dependency and container scanning oExperience setting up/running CSPM(s), policy tuning, etc

Detection and response oCan design alerting from CloudTrail/VPC flow logs/application logs and has experience integration into SIEM platform(s) oHas run or participated in incident response in a cloud environment and can automate containment steps

Working style oPragmatic about risk: prioritizes by actual exploitability and blast radius oCommunicates clearly with developers and explains the why so fixes stick oIs comfortable documenting controls and work guidance documents to aid in awareness of achieving of a more secure control environment. oMust be comfortable working and reporting to the Sr Director of Information Security, with a “dotted line” to the application team leadership.

oRelevant certs (AWS Security Specialty, OSCP, CKS) oCompliance exposure (SOC 2, ISO 27001, FedRAMP) a plus oFamiliarity with CSPM or cloud-native runtime security tools