JD 10 - Security, Risk & Compliance | Senior Consultant

JD 10 - Security, Risk & Compliance | Senior Consultant

The Depository Trust & Clearing Corporation | | Source Row 72 | RR(s): RR-0708212

Client Name (Column AD)	The Depository Trust & Clearing Corporation
Job Description (Column W)	Included below under Role Scope & Key Responsibilities
Role Specialization (Column G)	Security, Risk & Compliance
Role Experience (Column F)	Senior Consultant - L6, 8+ years relevant experience

Role Summary

Lead AWS Security Agent implementation and operationalization for financial services migration, specializing in multi-account security guardrails, IAM/SSO policy design, and regulatory compliance (NIST CSF 2.0, DORA, PCI DSS, SEC cyber rules). Architect threat modeling frameworks (STRIDE/PASTA) across 15+ AWS services, design penetration testing validation workflows, and establish AWS Backup logical air gap architectures. Author DTCC-aligned security requirements, operational runbooks, and security baseline configurations for Amazon EKS environments while ensuring compliance with financial services regulatory standards.

Role Scope & Key Responsibilities (from Column W)

Primary Responsibilities:

• Security Agent Leadership (WS-1): Design and implement AWS Security Agent access control models, author DTCC-aligned custom security requirements, validate penetration testing findings, and establish operational security baselines
• Identity & Access Management: Configure AWS IAM Identity Center (SSO) with federated authentication, design per-Agent-Space IAM deny policies, implement least-privilege Service Control Policies (SCPs), and establish cross-account access patterns
• Threat Modeling Leadership (WS-4): Lead STRIDE/PASTA threat modeling workshops across up to 15 AWS services, produce comprehensive threat registers, prioritize security control backlogs, and map controls to identified threats
• Security Documentation: Author Security Agent Architecture & Design Document, operational runbooks, security implementation guides, and compliance validation frameworks aligned with DTCC security standards
• Amazon EKS Security: Design and implement Amazon EKS security baseline configurations, pod security policies/standards, network policies, secrets encryption, and lab environment security controls
• Backup & Recovery Security: Design AWS Backup logical air gap architectures with WORM vault locking, cross-account/cross-region backup strategies, and immutable backup validation
• Regulatory Compliance: Review and incorporate customer organizational security requirements into AWS deliverables, validate implementations against NIST CSF 2.0, DORA, PCI DSS, and SEC cyber rules
• Penetration Testing Coordination: Coordinate penetration testing activities via Security Agent, validate findings, prioritize remediation, and implement security hardening measures

Key Deliverables:

• Security Agent Architecture & Design Document
• IAM Identity Center SSO configuration with per-Agent-Space policies
• STRIDE/PASTA threat registers and prioritized security control backlogs
• Security Agent operational runbooks and implementation guides
• Amazon EKS security baseline and lab environment configurations
• AWS Backup logical air gap architecture design
• Compliance validation reports (NIST CSF 2.0, DORA, PCI DSS, SEC)

Penetration testing validation reports and remediation plans

AWS Skills & Services (added)

Security & Compliance:

• AWS Security Hub: Centralized security findings aggregation, compliance standards (CIS, PCI-DSS, NIST), automated remediation workflows, custom insights, and cross-account security posture management
• AWS IAM Identity Center (SSO): SAML/OIDC federation, multi-account access management, permission sets, session policies, MFA enforcement, and identity provider integration
• AWS IAM: Advanced policy authoring (identity-based, resource-based, permission boundaries), SCP design for multi-account guardrails, deny policies, least-privilege access patterns, and cross-account roles
• AWS Organizations: Multi-account strategy, OU structure design, SCP policies, consolidated billing, and cross-account governance
• AWS GuardDuty: Threat detection, malware protection, runtime monitoring, S3 protection, EKS protection, and automated threat response
• Amazon Macie: Sensitive data discovery, PII detection, S3 bucket classification, compliance reporting, and data loss prevention
• AWS Config: Configuration compliance, conformance packs (NIST, PCI-DSS), remediation actions, resource inventory, and drift detection
• AWS CloudTrail: Multi-region trails, log file validation, CloudTrail Insights, event history analysis, cross-account logging, and immutable audit trails
• AWS Audit Manager: Compliance framework automation (NIST CSF 2.0, DORA, PCI DSS, SEC), evidence collection, audit-ready reports, and continuous compliance monitoring
• AWS Security Lake: Centralized security data lake (OCSF format), log aggregation, threat hunting, and SIEM integration
• AWS Secrets Manager: Secure credential management, secret rotation, cross-account access, and integration with IAM policies
• AWS KMS: Customer Managed Keys (CMKs), key policies, cross-region key replication, envelope encryption, CloudHSM integration, and FIPS 140-2 compliance

Backup & Disaster Recovery:

• AWS Backup: Centralized backup management, WORM vault locking (Vault Lock), logical air gap design, cross-account/cross-region backup, 3-2-1 backup strategy, and compliance reporting
• AWS Backup Audit Manager: Compliance framework design, backup policy enforcement, audit reporting, and validation testing
• Amazon S3: Object Lock (WORM compliance), versioning, cross-region replication, Glacier Vault Lock, and immutable storage configurations

Container & Compute Security:

• Amazon EKS: Cluster hardening, pod security policies/standards, IRSA (IAM Roles for Service Accounts), network policies, secrets encryption (AWS Secrets Manager/KMS integration), runtime security (Falco/Sysdig), and security baseline configurations
• Amazon ECR: Image scanning (basic/enhanced), vulnerability assessment, immutable tags, lifecycle policies, encryption, and private registry configurations
• AWS Systems Manager: Patch Manager, Session Manager (bastion replacement), Parameter Store encryption, Run Command, and hardened AMI automation

Networking & Isolation:

• Amazon VPC: Advanced networking, security groups, NACLs, VPC Flow Logs, VPC peering, PrivateLink, Transit Gateway route isolation, and network segmentation
• AWS Network Firewall: Stateful/stateless rules, intrusion prevention, domain filtering, TLS inspection, and threat intelligence integration
• AWS WAF: Web application protection, managed rule groups, rate limiting, bot control, and custom rule sets
• AWS Shield: DDoS protection (Standard/Advanced), attack mitigation, cost protection, and incident response
• AWS PrivateLink: Service endpoint isolation, cross-account connectivity without internet exposure

Threat Modeling & Penetration Testing:

• STRIDE Methodology: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege threat modeling
• PASTA Framework: Process for Attack Simulation and Threat Analysis across AWS services
• AWS Inspector: Vulnerability scanning for EC2/ECR, network reachability analysis, and compliance assessments
• Amazon Detective: Security investigation, graph-based analysis, threat hunting, and incident response

Monitoring & Observability:

• Amazon CloudWatch: Security metrics, log aggregation, anomaly detection, alarms, dashboards, and CloudWatch Logs Insights
• AWS X-Ray: Distributed tracing for security event correlation
• Amazon EventBridge: Event-driven security automation, cross-account event routing, and automated remediation workflows
• AWS Step Functions: Automated incident response workflows, security orchestration, and compliance validation

Governance & Compliance:

• AWS Control Tower: Landing zone automation, guardrails, Account Factory, compliance dashboards, and multi-account governance
• AWS Service Catalog: Compliance-approved resource templates, self-service provisioning, and security baseline enforcement
• AWS Resource Access Manager (RAM): Cross-account resource sharing with security controls
• Financial Services Compliance:
• NIST Cybersecurity Framework (CSF) 2.0: Identify, Protect, Detect, Respond, Recover, Govern framework implementation on AWS
• DORA (Digital Operational Resilience Act): ICT risk management, incident reporting, operational resilience testing, third-party risk management
• PCI DSS: Payment Card Industry Data Security Standard compliance (network segmentation, encryption, access control, monitoring)

SEC Cybersecurity Rules: Incident disclosure, risk management, governance, and cybersecurity expertise requirements

Financial Services & Industry Skills (added)

• Large regulated financial-services delivery with formal change-control, audit and risk governance
• Operational resilience expectations including RTO/RPO, multi-region DR and evidence for audit review
• Awareness of applicable controls and regulations such as DORA, NIST CSF 2.0, PCI DSS, SEC cyber rules, RegSCI and SIFMU/FMI expectations where relevant
• Ability to create Tech Risk-ready documentation including ADRs, runbooks, design docs, threat models and validation evidence
• Clear communication with client engineering, security, SRE, data and platform stakeholders as an embedded SME

Certifications / Qualifications

• AWS Certified Security - Specialty
• AWS Certified Solutions Architect - Professional
• AWS Certified Advanced Networking - Specialty nice to have

General Requirements

• 8+ years of relevant hands-on delivery experience at L6 scope
• Prior delivery in a large regulated enterprise environment, preferably financial services
• Ability to write architecture decision records, design documents, runbooks and test evidence for client Tech Risk review
• Strong stakeholder communication across engineering, security, operations, SRE and delivery teams
• Compliance with AWS ProServe and client onboarding, security, vetting and time-zone overlap requirements