Security Architect

Principal AWS Cloud Security Engineer / Cloud Security Architect

Position Summary

This is a hands-on architecture and engineering role within Cybersecurity Architecture (CSA). The role secures the AWS platform behind the IRM product estate, including Horizon, CRC & OCN (Masscomm), and Legacy Masscomm platforms.

You will design and implement the cloud security guardrails that allow IRM engineering teams to move faster with less risk: AWS account structure, landing zones, IAM and SCP controls, EKS and container security, network exposure reduction, secrets and encryption patterns, cloud logging, posture management, and infrastructure-as code guardrails.

This role reports through CSA, with dedicated day-to-day alignment to CloudOps, DevOps, platform engineering, and the product-security resources in PSOE.

Required Qualifications

Experience

Senior hands-on experience securing production AWS environments for client-facing or mission-critical workloads.

Proven experience with AWS Organizations, multi-account architecture, landing zones, SCPs, IAM, VPC networking, EKS / Kubernetes, KMS, secrets management, and cloud logging.

Practical experience turning cloud posture findings into remediated infrastructure and reusable patterns. Experience working with DevOps, CloudOps, platform engineering, and product teams in delivery-oriented environments.

Technical Skills

Strong AWS architecture and security engineering skills.

Infrastructure-as-code and policy-as-code experience, preferably with Terraform or equivalent tooling. Working knowledge of CSPM / CNAPP concepts, container security, cloud detection, and cloud resilience. Ability to design controls that are automated, auditable, and usable by engineering teams.

Familiarity with CIS AWS Benchmarks, NIST CSF, NIST SP 800-53, and Zero Trust concepts.

Soft Skills and Behaviours

Practical architecture judgment: able to reduce real risk without creating review bottlenecks.

Strong communication with platform engineers, product leaders, CyberOps, GRC, and executives.

Comfortable operating through influence in a federated environment.

Bias toward reusable patterns, measurable remediation, and clear ownership.

Certifications (Preferred)

AWS Security - Specialty, AWS Solutions Architect Professional, or equivalent cloud-security credentials.

CISSP, CCSP, Kubernetes security, or infrastructure-security certifications are assets.