Note: The job is a remote job and is open to candidates in USA. HanaByte is a cloud security company focused on infrastructure and intelligent workflow automation for regulated industries. The Senior Cloud Security Consultant independently leads identity and automation workstreams, designing and implementing Microsoft identity, Windows infrastructure, PKI, regulated end-user computing, AWS security, and compliance solutions from discovery through client acceptance.
Responsibilities
- Independently lead and deliver specialist workstreams from requirements validation and design through implementation, testing, documentation, and client acceptance
- Design and administer Active Directory on Amazon EC2 and AWS Managed Microsoft AD, including DNS, Group Policy, trusts, replication, service accounts, and integration with Microsoft Entra ID and AWS IAM Identity Center
- Implement SAML, SSO, SCIM provisioning, MFA, Duo, RADIUS, and certificate-based authentication
- Design and operate PKI using Active Directory Certificate Services and AWS Private CA, including certificate issuance, renewal, revocation, trust distribution, and authentication across Windows, Linux, macOS, and Amazon WorkSpaces
- Design and secure regulated end-user compute environments using Amazon WorkSpaces, Amazon AppStream 2.0, and Research and Engineering Studio on AWS, including Windows and Linux images, session policies, and private CA trust
- Design and troubleshoot supporting networking and integrate AWS, Windows, directory, authentication, and endpoint telemetry with SIEM platforms (preference with Splunk and Google SecOps)
- Translate requirements from CMMC 2.0, NIST SP 800-171, NIST SP 800-53, FedRAMP, FedRAMP 20x, HIPAA, and similar frameworks into technical requirements, implementations, acceptance tests, and evidence
- Support FedRAMP 20x approaches involving measurable security outcomes, machine-readable requirements, automated evidence, persistent validation, and continuous monitoring
- Understand, troubleshoot, maintain, and extend existing Terraform implementations, and develop reusable Terraform modules and Bash automation
- Contribute specialist expertise to AWS Control Tower and Landing Zone Accelerator environments while supporting existing CloudFormation and AWS CDK components when necessary
- Produce clear client deliverables, including architecture diagrams, implementation guides, runbooks, control mappings, test procedures, and evidence packages
Skills
- • Five or more years of hands-on experience designing, securing, and troubleshooting production AWS environments
- • Five or more years of enterprise experience with Windows Server, Active Directory, identity services, and PKI
- • Deep experience with Active Directory, Microsoft Entra ID, AWS IAM Identity Center, SAML, SSO, SCIM, Group Policy, MFA, Duo, and RADIUS
- • Deep PKI experience with Active Directory Certificate Services, AWS Private CA, certificate lifecycles, trust chains, and certificate-based authentication
- • Experience securing Amazon WorkSpaces, Amazon AppStream 2.0, and Research and Engineering Studio on AWS
- • Strong Windows Server administration and sufficient Linux administration experience to manage images, authentication, certificates, and trust stores
- • Strong networking fundamentals, including TCP/IP, DNS, routing, firewalls, security groups, VPNs, and hybrid connectivity
- • Experience integrating infrastructure and security telemetry with a SIEM such as Google SecOps, Splunk, Microsoft Sentinel, or an equivalent platform
- • Ability to interpret security controls and turn them into technical requirements, automated configurations, validation procedures, and evidence
- • Hands-on experience applying CMMC, NIST, FedRAMP, or comparable regulated security requirements
- • Deep Terraform expertise, including existing codebases, reusable modules, providers, remote state, CI/CD pipelines, and multi-account AWS architectures
- • Strong Bash and shell scripting skills for automation, deployment, troubleshooting, testing, and evidence collection
- • Experience with AWS Organizations, AWS Control Tower, AWS Landing Zone Accelerator, Git, and pull-request-based change management
- • Ability to understand and support existing AWS CloudFormation and AWS CDK implementations
- • Proven ability to independently own customer-facing technical workstreams with strong communication and technical writing skills
- • AWS Certified Security – Specialty must be held at hire or obtained within the first 90 days of employment
- • AWS Partner: Accreditation (Business) and AWS Partner: Accreditation (Technical), or their current equivalents, must be completed within the first 90 days
- • Credentials support, but do not replace, the required hands-on experience
- • Google Cloud experience, particularly with Cloud Identity, IAM, Security Command Center, VPC Service Controls, Assured Workloads, or Google SecOps
- • Python or another general-purpose programming language for automation, API integrations, testing, or internal tooling
- • Microsoft identity or Windows Server certifications, including SC-300, AZ-800/AZ-801, or their successor credentials
- • Experience with AWS GovCloud, the Defense Industrial Base, government contractors, public-sector organizations, or higher-education central IT
- • Experience with GxP-regulated systems, healthcare, life sciences, HIPAA, PHI, validation documentation, data integrity, or change control
- • Experience with high-performance computing using Slurm, AWS ParallelCluster, or comparable HPC technologies
- • Experience with AWS AI/ML services such as Amazon SageMaker or Amazon Bedrock
- • Advanced security or compliance certifications such as CISSP, CCSP, CyberAB CCP, or CyberAB CCA
Company Overview