Description

• Design and build a secure, multi-account AWS environment for hosting vendor AI tools, with each vendor isolated in its own account.
• Turn it into a reusable template so new vendors can be onboarded in days.
• Build private, tightly controlled network paths from the lab and corporate networks to the environment, and lock down outbound traffic to approved destinations only.
• Set up encryption, key management, identity and access, with least privilege throughout.
• Send logs and alerts to our SIEM (Microsoft Sentinel).
• Review vendor deployment requirements and approve only what's needed.
• Put cost controls in place: tagging, budgets, and scaling down when idle.
• Write runbooks and hand over to SecOps for day-to-day operations.

Must-have skills

• 5+ years in cloud security or cloud infrastructure engineering, with at least 3 years hands-on in AWS
• Multi-account AWS design: Organizations, Control Tower or Account Factory, service control policies, IAM least privilege
• Infrastructure as code: Terraform (or CloudFormation/CDK), deployed through CI/CD
• AWS networking: VPC design, PrivateLink, Transit Gateway, site-to-site VPN or Direct Connect, egress control
• Encryption and secrets: KMS with customer-managed keys, Secrets Manager
• Security monitoring: CloudTrail, GuardDuty, Security Hub, AWS Config, and forwarding logs to a SIEM
• Container security: EKS or ECS
• Experience deploying third-party software into a controlled environment, and working directly with vendors on it

Nice to have

• Amazon Bedrock or SageMaker, or securing AI/ML workloads
• Semiconductor, EDA or HPC environments
• Single sign-on from Entra ID into AWS (IAM Identity Center)
• Azure experience and AWS Certified Security – Specialty

Key Skills

Education

Bachelor's degree