Security Architect

Principal AWS Cloud Security Engineer / Cloud Security Architect

Position Summary

This is a hands-on architecture and engineering role within Cybersecurity Architecture (CSA). The role secures the AWS platform behind the IRM product estate, including Horizon, CRC & OCN (Masscomm), and Legacy Masscomm platforms.

You will design and implement the cloud security guardrails that allow IRM engineering teams to move faster with less risk: AWS account structure, landing zones, IAM and SCP controls, EKS and container security, network exposure reduction, secrets and encryption patterns, cloud logging, posture management, and infrastructure-as code guardrails.

This role reports through CSA, with dedicated day-to-day alignment to CloudOps, DevOps, platform engineering, and the product-security resources in PSOE.

Required Qualifications

Experience

● Senior hands-on experience securing production AWS environments for client-facing or mission-critical workloads.

● Proven experience with AWS Organizations, multi-account architecture, landing zones, SCPs, IAM, VPC networking, EKS / Kubernetes, KMS, secrets management, and cloud logging.

● Practical experience turning cloud posture findings into remediated infrastructure and reusable patterns. Experience working with DevOps, CloudOps, platform engineering, and product teams in delivery-oriented environments.

Technical Skills

● Strong AWS architecture and security engineering skills.

● Infrastructure-as-code and policy-as-code experience, preferably with Terraform or equivalent tooling. Working knowledge of CSPM / CNAPP concepts, container security, cloud detection, and cloud resilience. Ability to design controls that are automated, auditable, and usable by engineering teams.

● Familiarity with CIS AWS Benchmarks, NIST CSF, NIST SP 800-53, and Zero Trust concepts.

Soft Skills and Behaviours

● Practical architecture judgment: able to reduce real risk without creating review bottlenecks.

● Strong communication with platform engineers, product leaders, CyberOps, GRC, and executives.

● Comfortable operating through influence in a federated environment.

● Bias toward reusable patterns, measurable remediation, and clear ownership.

Certifications (Preferred)

● AWS Security - Specialty, AWS Solutions Architect Professional, or equivalent cloud-security credentials.

● CISSP, CCSP, Kubernetes security, or infrastructure-security certifications are assets.