Description

Design and build a secure, multi-account AWS environment for hosting vendor AI tools, with each vendor isolated in its own account.

Turn it into a reusable template so new vendors can be onboarded in days.

Build private, tightly controlled network paths from the lab and corporate networks to the environment, and lock down outbound traffic to approved destinations only.

Set up encryption, key management, identity and access, with least privilege throughout.

Send logs and alerts to our SIEM (Microsoft Sentinel).

Review vendor deployment requirements and approve only what is needed.

Put cost controls in place: tagging, budgets, and scaling down when idle.

Write runbooks and hand over to SecOps for day-to-day operations.

Must-have skills

5+ years in cloud security or cloud infrastructure engineering, with at least 3 years hands-on in AWS.

Multi-account AWS design: Organizations, Control Tower or Account Factory, service control policies, IAM least privilege.

Infrastructure code: Terraform (or CloudFormation/CDK), deployed through CI/CD.

AWS networking: VPC design, Private Link, Transit Gateway, site-to-site VPN or Direct Connect, egress control.

Encryption and secrets: KMS with customer-managed keys, Secrets Manager.

Security monitoring: CloudTrail, Guard Duty, Security Hub, AWS Config, and forwarding logs to a SIEM.

Container security: EKS or ECS.

Experience deploying third-party software into a controlled environment and working directly with vendors.

Nice to have

Amazon Bedrock or SageMaker, or securing AI/ML workloads.

Semiconductor, EDA, or HPC environments.

Single sign-on from Entra ID into AWS (IAM Identity Center).

Azure experience

Key Skills

Education

Bachelor's degree