Role : AWS Cloud Engineer(Network Security & IOM Remediation)

Level:- Senior (Individual Contributor)

Experience:- 10 Years to 16 Years

Duration:- Long-term / Ongoing

Location :- Remote

About the Role

We are seeking a contract AWS Cloud Engineer to own the resolution of security findings and Indicators of Misconfiguration (IOMs) across a multi-account AWS environment.

You will architect, harden, and maintain the cloud networking and infrastructure layer - VPCs, Transit Gateways, security groups, IAM policies, and encryption controls - while systematically triaging and remediating findings surfaced by CrowdStrike Falcon Cloud Security, AWS Security Hub, and GuardDuty.

You will partner with a US-based Platform Engineering team (which owns EKS clusters, CI/CD pipelines, and application workloads) to ensure the underlying AWS infrastructure meets security baselines and compliance requirements.

This is a fully remote, long-term contract engagement requiring a minimum of 4 hours daily overlap with US Eastern business hours. Strong written and verbal English communication is essential - you will collaborate daily with US-based engineers and stakeholders via Teams, Jira, and Confluence.

Core Responsibilities :

Security Finding Triage & IOM Remediation :

- Own the full lifecycle of IOMs and security findings: triage, prioritize, remediate, validate, and document across all AWS accounts.

- Remediate misconfigurations across VPCs, security groups, NACLs, S3 bucket policies, IAM roles/policies, encryption settings, and logging configurations.

- Build automated remediation workflows using Lambda, Step Functions, or EventBridge to address recurring finding patterns at scale.

- Perform root cause analysis on IOMs and implement preventive controls (SCPs, Config rules, guardrails) to prevent recurrence.

- Track remediation progress against severity-based SLAs and provide regular reporting to security leadership.

- Coordinate with InfoSec and the CrowdStrike team on finding validation, exception requests, and risk acceptance documentation.

Network Architecture & Security :

- Design and implement secure VPC architectures: subnet segmentation, route tables, NAT gateways, VPC peering, and Transit Gateway topologies across a multi-account AWS Organizations structure.

- Architect and manage network security controls: security groups, NACLs, AWS Network Firewall policies, and prefix list management for hybrid connectivity.

- Implement and maintain hybrid connectivity (Direct Connect, Site-to-Site VPN) with appropriate encryption and access controls.

- Design internal ALB/NLB ingress patterns with proper TLS termination, certificate management (ACM), and origin restriction via security group prefix lists.

- Configure and manage PrivateLink endpoints, VPC endpoint policies, and DNS resolution (Route 53 private/public hosted zones) for secure service access.

- Enforce network segmentation aligned with zero-trust principles - no public-facing resources without explicit approval and compensating controls.

IAM & Access Architecture :

- Design and enforce IAM strategies following least-privilege principles: permission boundaries, SCPs, role trust policies, and condition keys.

- Audit and remediate overly permissive IAM policies, cross-account trust relationships, and unused credentials.

- Implement and maintain OIDC-based authentication patterns for CI/CD runners and workload identities (IRSA for EKS).

- Manage AWS Organizations SCPs and Control Tower guardrails to enforce security baselines across all accounts.

Infrastructure-as-Code & Compliance

- Implement and enforce IaC security standards using Terraform with policy-as-code validation (OPA, Sentinel, cfn-guard, tfsec).

- Author and maintain AWS Config rules and conformance packs for continuous compliance monitoring.

- Build and maintain Terraform modules for secure-by-default infrastructure patterns (VPCs, security groups, IAM roles) that application teams consume.

- Ensure all infrastructure changes flow through code review and automated validation - no manual console changes in production accounts.

Monitoring & Observability :

- Configure and maintain VPC Flow Logs, CloudTrail, DNS query logging, and S3 access logging with centralized analysis (Athena, CloudWatch Logs Insights).

- Build dashboards and alerting for security posture metrics: open finding counts, MTTR trends, compliance drift, and SLA adherence.

- Participate in security incident response related to network intrusion, unauthorized access, or data exfiltration indicators.

- Maintain audit trails and compliance evidence for SOC 2 / PCI workloads as applicable.

Required Technical Skills :

AWS Networking & Architecture :

- Over all 10+ years of IT experience and 5+ years of AWS experience with deep expertise in networking services: VPC, Transit Gateway, Direct Connect, Route 53, ALB/NLB, CloudFront, PrivateLink, and Network Firewall.

- Multi-account AWS Organizations architecture: account vending, centralized networking, shared services patterns, and cross-account resource access.

- Strong understanding of TCP/IP networking, DNS resolution, TLS/mTLS, and network security protocols.

- Practical experience with EKS networking: VPC CNI, security groups for pods, network policies, and ingress controller integration (AWS ALB Controller).

Security & Compliance :

- 3+ years working directly with CSPM tools (CrowdStrike Falcon Cloud Security, AWS Security Hub, or equivalent) and remediating findings at scale (hundreds/thousands of IOMs).

- Hands-on IAM expertise: policy authoring, permission boundaries, SCPs, role trust policies, condition keys, and cross-account access patterns.

- Working knowledge of compliance frameworks (CIS AWS Benchmarks, NIST 800-53, SOC 2) and how they map to specific AWS controls.

- Experience with AWS native security services: GuardDuty, Inspector, Macie, Config, CloudTrail, and Security Hub.

Infrastructure-as-Code :

- Terraform (required): module authoring, state management, workspace patterns, and CI/CD integration for infrastructure pipelines.

- Policy-as-code: OPA/Rego, tfsec, checkov, cfn-guard, or HashiCorp Sentinel for pre-deployment validation.

- Git-based workflows for infrastructure changes with peer review and automated plan/apply patterns.

Automation & Scripting :

- Python or Go for building security automation, remediation lambdas, and custom Config rules.

- Bash scripting for operational automation and runbook implementation.

- Experience with AWS SDK (boto3) and CLI for programmatic infrastructure management.

Communication & Collaboration :

- Professional English proficiency - written and verbal - sufficient for daily technical collaboration with US-based engineers, product managers, and InfoSec stakeholders.

- Availability for a minimum 4-hour daily overlap with US Eastern business hours (8am-6pm EST/EDT); core collaboration windows will be scheduled within this window.

- Comfort working in a distributed, async-first team: proactive written status updates, well-documented pull requests and runbooks, and clear escalation communication.

- Proficiency with standard remote collaboration tooling: Microsoft Teams (chat, video, channels), Jira (ticket tracking and sprint ceremonies), and Confluence (documentation).

- Experience working as an external contractor or vendor resource embedded in a client engineering team; ability to ramp independently with minimal hand-holding.

Preferred / Nice-to-Have :

- AWS Solutions Architect Professional or AWS Security Specialty certification.

- Experience with AWS Network Firewall, Gateway Load Balancer, or third-party NGFW integration (Palo Alto, Fortinet).

- Background in automating security remediation at scale - event-driven architectures that auto-resolve known finding patterns.

- Experience with eBPF-based network observability or runtime security tools.

- Familiarity with Kubernetes security primitives (Pod Security Standards, RBAC, network policies) from an infrastructure perspective.

- Experience working in regulated environments (SOC 2, PCI-DSS, HIPAA) with compliance-as-code tooling.

- Knowledge of DNS security (DNSSEC, DNS firewall, Route 53 Resolver rules) and DDoS mitigation (Shield Advanced, WAF).

Success Metrics (6-12 Months) :

- Critical and high IOMs reduced by 80%+ with documented root cause and preventive controls in place for each resolved finding category.

- Mean time to remediate (MTTR) for critical findings under 72 hours; high findings under 14 days - consistently meeting SLA targets.

- All VPCs, security groups, and IAM roles audited and hardened; zero public-facing resources without explicit approval and compensating controls.

- Secure-by-default Terraform modules published and adopted by platform teams - new infrastructure deploys pre-validated against CIS benchmarks.

- Automated remediation workflows handling 30%+ of recurring finding patterns without manual intervention.

- Continuous compliance dashboards operational with real-time visibility into security posture across all accounts.

- Network architecture documented end-to-end: topology diagrams, connectivity patterns, firewall rules, and data-flow documentation current and maintained.