Job Summary
The AWS Security Engineer is responsible for identifying, prioritizing, and remediating cloud and application security vulnerabilities across AWS accounts and environments. The role focuses on securing AWS ECS workloads, Docker containers, IAM configurations, networking, Cognito identity pools, and data-protection controls. This position requires hands-on experience with cloud security remediation, DevOps practices, infrastructure as code, application dependency updates, vulnerability management, and production change controls. The engineer will work with Cloud Security teams to validate fixes, reduce recurring findings, and maintain secure, reliable cloud environments.
Key Responsibilities
• Maintain an inventory and remediation backlog covering all AWS accounts and environments, deduplicating related findings and documenting owners, severity, dependencies, fixes, validation, and status.
• Remediate exposed and over-privileged AWS ECS workloads by patching vulnerable base images and packages, restricting ingress, minimizing task permissions, and protecting sensitive data access.
• Build, rebuild, scan, deploy, and roll back Docker container images and AWS ECS services using appropriate task definitions and deployment practices.
• Investigate and remediate Cognito Identity Pool misconfigurations, insecure IAM trust relationships, and unintended unauthenticated access.
• Design and remediate AWS IAM policies and roles using least-privilege principles, including permission analysis, trust-policy remediation, workload credentials, and task role versus task execution role separation.
• Implement AWS data-protection controls, including DynamoDB deletion protection, access restrictions, encryption, and recovery safeguards where required.
• Address applicable EC2, Windows Server, and operating-system vulnerabilities through patching or approved mitigations, coordinating specialist support when necessary.
• Build and deploy tested changes safely across development, test, and production environments, including rollback plans, monitoring, and operational documentation.
• Coordinate with Cloud Security teams to rescan environments, verify remediation, and provide technical evidence for closing security findings.
• Escalate remediation blockers and residual risks promptly rather than treating exceptions as permanent fixes.
• Reduce recurring security findings through automation, dependency update processes, hardened container images, CI/CD security checks, and configuration standards.
• Secure AWS networking components, including VPCs, subnets, security groups, and load balancers, while managing HTTPS ingress, public and private exposure, and attack-surface reduction.
• Remediate vulnerable application dependencies, including Node.js/npm packages and TypeORM, resolve breaking changes, rebuild containers, and execute regression tests.
• Investigate and remediate cloud and application vulnerabilities identified through Wiz, Veracode, and CVE assessments, prioritizing exploitability and potential data exposure.
• Implement code scanning and quality controls using SonarQube, resolve security and quality issues, and establish realistic code coverage targets and quality gates for legacy applications.
• Use AWS CloudWatch, CloudTrail, Systems Manager, AWS Config, Security Hub, GuardDuty, and container registries such as Amazon ECR to support security monitoring, investigation, and remediation.
• Use Python, Bash, or PowerShell scripts to automate operational and security tasks.
• Investigate unfamiliar legacy systems with incomplete documentation and identify practical remediation approaches.
• Support legacy MQTT/IoT integrations and bridge services where applicable.
• Apply security benchmarks and practices aligned with CIS and NIST, supporting incident response and data protection.
Required Qualifications
• Hands-on experience with AWS ECS and Docker, including ECS services, task definitions, container images, image scanning, deployment, rollback, and task role versus task execution role configurations.
• Strong AWS IAM and identity management experience, including least-privilege policy design, role and trust-policy remediation, permission analysis, workload credentials, and AWS Cognito Identity Pools.
• Experience with Cognito Identity Pools, including unauthenticated identities and audience (aud) and authentication method reference (amr) conditions.
• Strong understanding of AWS networking, including VPCs, subnets, security groups, load balancers, HTTPS ingress, public and private exposure, and attack-surface reduction.
• Experience with Git, CI/CD, infrastructure as code using Terraform or CloudFormation, release automation, logging, troubleshooting, and production change controls.
• Working knowledge of Node.js/npm and TypeScript, including the ability to upgrade vulnerable TypeORM and other libraries, resolve breaking changes, rebuild containers, and run regression tests.
• Experience interpreting Wiz findings and CVEs, prioritizing vulnerabilities based on exploitability and data exposure, implementing fixes, and providing technical evidence for closure.
• Proficiency in Python, Bash, or PowerShell for operational scripting and troubleshooting.
• Experience investigating legacy systems with incomplete documentation.
• Experience implementing cloud security remediation across development, test, and production environments.
• Strong understanding of security remediation validation, risk prioritization, and production deployment safeguards.
Preferred Qualifications
• Experience with AWS CloudWatch, CloudTrail, Systems Manager, AWS Config, Security Hub, GuardDuty, and Amazon ECR.
• Experience with legacy MQTT/IoT integrations and bridge services.
• Working knowledge of Windows Server patching and DynamoDB.
• Familiarity with CIS/NIST security benchmarks, infrastructure incident response, and data-protection controls.
• AWS certifications relevant to cloud security or infrastructure.
• Experience with Kubernetes/EKS; however, Kubernetes is not required for the identified ECS workloads.
• Experience using Wiz and Veracode to identify, remediate, and validate cloud and application security vulnerabilities, including coordinating rescans and closing findings.
• Experience with SonarQube, including code scanning, security and quality remediation, code coverage targets, and quality gates for legacy applications.
