Security Engineer (App Dev)- onsite

AWS security / fundamentals

oDeep IAM fluency: least-privilege policy design, roles vs. users, permission boundaries, cross-account trust, and spotting over-privileged automation identities

oHands-on with the AWS security stack: GuardDuty, Security Hub, CloudTrail, Config, Inspector, KMS, Secrets Manager, VPC/network controls

oUnderstands the shared responsibility model and where the application s exposure actually sits (S3 policies, security groups, public endpoints, etc.)

Automation and infrastructure-as-code

oCan read and review Terraform/CloudFormation/CDK/etc, and knows how to put security checks into the pipeline (tfsec, Checkov, policy-as-code like OPA)

oComfortable auditing Lambda, Step Functions, EventBridge, and scheduled jobs for insecure defaults, secret sprawl, and excessive permissions

oTreats CI/CD as an attack surface: pipeline credentials, OIDC federation, artifact integrity, supply-chain risk

Secure engineering

oCan write production-quality code (Python, Go, or similar) and can build security tooling

oExperience with threat modeling for event-driven and service-to-service architectures, including non-human identities and machine-to-machine auth

oKnows application security basics: OWASP, auth/session handling, input validation, dependency and container scanning

oExperience setting up/running CSPM(s), policy tuning, etc

Detection and response

oCan design alerting from CloudTrail/VPC flow logs/application logs and has experience integration into SIEM platform(s)

oHas run or participated in incident response in a cloud environment and can automate containment steps

Working style

oPragmatic about risk: prioritizes by actual exploitability and blast radius

oCommunicates clearly with developers and explains the why so fixes stick

oIs comfortable documenting controls and work guidance documents to aid in awareness of achieving of a more secure control environment.

oMust be comfortable working and reporting to the Sr Director of Information Security, with a "dotted line" to the application team leadership.

Nice to have

oRelevant certs (AWS Security Specialty, OSCP, CKS)

oCompliance exposure (SOC 2, ISO 27001, FedRAMP) a plus

oFamiliarity with CSPM or cloud-native runtime security tools