AWS Cloud Security Architect

Job Summary

To support a growing practice, the full-time AWS Cloud Security Architect will be responsible for authoring and implementing Service Control Policies (SCPs) and Resource Control Policies (RCPs), managing Terraform-compatible policy code delivery, and conducting blast radius analysis, all while working remotely.

Key responsibilities

• Author and implement SCP and RCP policy rule sets for AWS services, ensuring compliance and functionality
• Deliver policy artifacts as Terraform-compatible code for deployment and validate syntax in non-production environments
• Conduct knowledge transfer sessions with engineering teams and develop operational runbooks for ongoing policy management

Required qualifications

• AWS Certified Security - Specialty certification
• Hands-on experience with authoring SCPs, RCPs, and VPC endpoint policies
• Strong Terraform/Infrastructure-as-Code skills, particularly with AWS Control Tower AFT
• Deep understanding of IAM policy language and phased deployment in multi-account AWS environments
• Familiarity with NIST and financial services compliance requirements