• Own the vulnerability-management lifecycle across cloud infrastructure, application code, dependencies, containers, CI/CD systems, and production services.
• Establish repeatable processes for vulnerability discovery, triage, severity assessment, ownership, remediation SLAs, exceptions, verification, and reporting.
• Drive critical and high-severity findings through closure by partnering with service owners and escalating unresolved risks when necessary.
• Implement and maintain security controls across AWS, including IAM, networking, encryption, key management, secrets, logging, and workload isolation.
• Integrate security into the software-development lifecycle through practical guardrails such as SAST, DAST, dependency scanning, secret detection, container scanning, and infrastructure-as-code checks.
• Review security-sensitive designs and changes, perform threat modeling, and provide concrete recommendations to engineering teams.
• Improve security across public APIs, authentication and authorization, service-to-service communication, customer credentials, sensitive data, and software-supply-chain workflows.
• Coordinate third-party penetration tests and ensure findings are assigned, prioritized, remediated, and validated.
• Develop and maintain incident-response playbooks, participate in security incidents, facilitate tabletop exercises, and track corrective actions after incidents.
• Partner with Infrastructure and Observability teams to improve security logging, alerting, investigation workflows, and threat detection.
• Translate security policies and compliance controls into technical requirements, automated checks, and engineering work.
• Support SOC 2, ISO 27001, and other applicable assurance or regulatory initiatives through control implementation, evidence collection, and remediation of audit findings.
• Maintain clear reporting on security posture, vulnerability backlog, remediation performance, control coverage, and overdue risks.
• Create practical security guidance and documentation that helps engineers ship secure systems without unnecessary friction.

Qualifications

• 5+ years of hands-on experience in DevSecOps, cloud security, application security, security engineering, or a related role.
• Demonstrated experience building or operating a vulnerability-management program and driving findings through verified remediation.
• Strong knowledge of AWS security, including IAM, VPC networking, KMS, secrets management, logging, monitoring, and multi-account environments.
• Production experience with infrastructure as code, preferably Terraform.
• Experience securing CI/CD pipelines, preferably GitHub Actions, including identity, permissions, secrets, dependencies, and build artifacts.
• Practical experience with security tooling such as SAST, DAST, software-composition analysis, secret detection, container scanning, cloud-security posture management, and infrastructure-as-code scanning.
• Solid understanding of common application-security risks, secure coding practices, authentication and authorization patterns, and the OWASP Top 10.
• Experience reviewing technical designs, conducting threat models, and turning identified risks into actionable engineering recommendations.
• Experience supporting security incident response, root-cause analysis, and corrective-action tracking.
• Familiarity with SOC 2, ISO 27001, CIS Benchmarks, or similar security and compliance frameworks.
• Ability to automate security workflows using Python, Bash, or another scripting language.
• Strong written and verbal communication skills, including the ability to explain risk, priorities, and remediation requirements to both engineers and leadership.
• A pragmatic, risk-based approach and a strong bias toward measurable execution.

Nice to Have

• Experience securing containerized or isolated workloads running on ECS, EKS, Kubernetes, or similar platforms.
• Experience with AWS Organizations, Control Tower, Security Hub, GuardDuty, AWS Config, CloudTrail, and IAM Identity Center.
• Experience securing distributed systems, public APIs, browser automation infrastructure, or systems that handle customer credentials and session data.
• Experience with SIEM, centralized security logging, and detection engineering.
• Experience automating compliance evidence collection or working with platforms such as Vanta.
• Experience coordinating penetration tests, red-team exercises, or customer security reviews.
• Security certifications such as CISSP, CISM, CCSP, AWS Security Specialty, or OSCP.