Note: The job is a remote job and is open to candidates in USA. InvestCloud is seeking a Cloud Security Architect to design and build the security architecture for its AWS SaaS platform. The role partners with development and infrastructure teams to secure cloud environments, automate guardrails, investigate risk, and help engineers build securely.
Responsibilities
- Design the security architecture for our AWS environment and take part in every stage of design and build alongside our development and infrastructure teams
- Set and maintain secure baselines for identity and access, network and firewall controls, containers and Kubernetes, storage, encryption, key management, and cryptography
- Design security logging and monitoring so we can see and investigate activity across every AWS account and workload
- Review cloud designs and changes and provide clear, practical answers that keep projects moving
- Build guardrails and automated checks that stop insecure configurations before they reach production
- Partner with our Application Security Architect to use Wiz to find and fix cloud risk, from code to runtime
- Write the reference architectures and patterns that let teams build securely without waiting on security
- Mentor engineers across the company
Skills
- Typically eight or more years of experience in security engineering or architecture, with at least five focused on hands-on AWS security in multi-account environments
- Expert knowledge of AWS identity, including IAM, AWS Organizations, service control policies, and IAM Identity Center
- Expert knowledge of AWS networking, including VPC design, security groups, AWS Network Firewall, and AWS WAF
- Expert knowledge of encryption, including KMS, CloudHSM, and certificate management
- Strong container security experience with Amazon EKS or ECS, including image security, runtime protection, and least-privilege workload identity
- Experience designing security logging with CloudTrail, VPC Flow Logs, GuardDuty, Security Hub, and a central log platform
- A working command of cryptography, including choosing the right algorithms, rotating keys, and protecting secrets
- Infrastructure as code skills in Terraform or CloudFormation, along with the ability to read and write code
- The ability to explain complex risk in plain language to engineers and executives alike
- Experience securing a SaaS platform for regulated customers, ideally in financial services
- Microsoft Azure or Microsoft 365 security experience
- Hands-on experience with Wiz or a similar cloud security platform
- AWS Certified Security Specialty certification, or equivalent depth of experience
Benefits
- Medical/Rx, dental, vision, disability, and life/AD&D insurance plans
- Flexible Savings Account (FSA)
- Health Savings Account (HSA)
- Employee Assistance Plan (EAP)
- Health advocacy
- Voluntary ancillary plans (accident, critical illness, hospital indemnity, legal, identity theft, auto/home, and pet insurance)
- 401(k) retirement savings plan with company match
- Paid time off
Company Overview
Company H1B Sponsorship