Cloud Security Specialist

Job Title: Security Expert

We are seeking a skilled Security Expert to lead our Application and Cloud Security programs.

Key Responsibilities:

• Conduct thorough security assessments across the application stack, including threat modeling, code reviews, dynamic scanning, and penetration testing.
• Develop and maintain secure software development life cycle (SDLC) practices, integrating security checks into continuous integration and continuous deployment (CI/CD) pipelines.
• Guide teams in secure design patterns, including secure authentication, input validation, access control, session management, and secure storage.
• Continuously monitor and remediate vulnerabilities in source code and dependencies, leveraging static application security testing (SAST), dynamic application security testing (DAST), and container scanning tools.
• Collaborate with engineering teams to define and enforce coding standards aligned with Open Web Application Security Project (OWASP) and Common Weakness Enumeration (CWE) guidelines.

Cloud & Infrastructure Security:

• Design and maintain secure configurations for cloud environments, focusing on networking, identity and access management, encryption, and logging best practices.
• Implement and manage security services, such as Amazon GuardDuty, AWS Inspector, and AWS Security Hub, to enhance cloud security postures.
• Define and enforce infrastructure-as-code (IaC) security controls using tools like Terraform, CloudFormation, or policy-as-code frameworks, ensuring consistent and secure deployments.
• Lead efforts in runtime protection, incorporating workload scanning, intrusion detection, and anomaly alerting to detect and respond to potential threats.
• Ensure centralized, secure log collection, monitoring, and alerting across all infrastructure components.

Security Architecture & Best Practices:

• Promote a shift-left approach to security, collaborating with developers early in the SDLC to provide actionable feedback during design, build, and review phases.
• Work closely with product managers and infrastructure leads to embed security into architectural decisions, particularly for high-risk features or regulated workflows.
• Establish and promote secure defaults, least-privilege access, and zero-trust architectural principles to minimize attack surfaces.
• Ensure robust key management and encryption standards are applied across data at rest, in transit, and in use.

Governance, Risk & Compliance:

• Support compliance initiatives by developing and documenting enforceable security controls.
• Collaborate with auditors and risk teams to demonstrate maturity of security processes and ongoing improvements.
• Establish internal security policies, operational procedures, and regular audit activities to ensure compliance and risk mitigation.

Requirements:

• 6+ years of experience in security engineering with a primary focus on application and cloud security.
• Proficiency with programming languages like Java, Python, JavaScript, and web technologies (e.g., HTML, CSS, SQL).
• In-depth knowledge of application security vulnerabilities, threat modeling, and SDLC integrations.
• Deep familiarity with cloud security architecture and services (AWS - IAM, VPC, KMS, GuardDuty, CloudTrail, etc.).
• Experience with DevSecOps tools and practices, including SAST, DAST, container scanning, and infrastructure scanning.
• Hands-on experience in implementing industry best practices in access control, encryption, and security observability.
• Excellent communication skills, with the ability to collaborate across engineering, product, and compliance teams.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Preferred Qualifications:

• Experience in high-compliance industries such as financial services, healthcare, or government.
• Familiarity with policy-as-code, secrets management tools, and container security.
• Certifications such as OSCP, AWS Security Specialty, or CISSP.

---