You’ll secure our clients’ cloud environments, from identity and network design to the pipelines that deploy into them. Some weeks you’ll harden a client’s AWS or Azure estate as part of our security services; other times you’ll be embedded in a client’s platform team. The goal is the same: make the secure way to build and ship also the easiest one.
What you’ll do
Review and harden AWS, Azure and GCP environments against CIS Benchmarks and the client’s own policies.
Design and enforce least-privilege IAM, workload identity instead of long-lived keys, and secrets storage and rotation.
Write and review infrastructure as code (Terraform, Pulumi or CloudFormation), with policy-as-code guardrails so misconfigurations fail the build.
Add container, dependency, secret and IaC scanning to CI/CD pipelines, and filter results down to what is actually exploitable.
Harden Kubernetes and container platforms: network policies, admission control, image baselines and an upgrade path.
Run cloud security posture management and track findings through to closure.
Produce evidence for ISO 27001, SOC 2, PCI DSS, NIS2 or DORA audits as a by-product of the platform, not as a separate project.
Lead incident response for cloud security events, and own the cloud security architecture decisions for each client.
What you bring
What you bring
Good command of English ( equivalent to IELTS 6.5 & above) is must requirement
7+ years in cloud, DevOps, SRE or platform engineering, including at least 3 years focused on security.
In-depth experience with at least one of AWS, Azure or GCP, including IAM, networking and logging.
Cloud network security: VPC/VNet design, private endpoints, security groups, cloud firewalls and WAF.
Cloud-native threat detection and logging, such as CloudTrail and GuardDuty, Microsoft Defender for Cloud, or Google Security Command Center.
Strong infrastructure as code with Terraform, Pulumi or CloudFormation.
CI/CD experience with GitHub Actions, GitLab CI or Azure DevOps, and scanners such as Trivy, Checkov, Semgrep, Snyk or Gitleaks.
Docker and Kubernetes in production, including RBAC and network policies.
Secrets management with tools such as HashiCorp Vault, AWS Secrets Manager or Azure Key Vault, and KMS key management.
Scripting in Python, Bash or Go.
Nice to have
AWS Security Specialty, Azure Security Engineer (AZ-500), Google Professional Cloud Security Engineer or CKS.
Policy-as-code tools such as OPA, Conftest or Kyverno, and signing tools such as cosign or Sigstore.
A CSPM platform such as Wiz, Prisma Cloud or Microsoft Defender for Cloud.
Experience working where controls had to pass an external audit.
