InfoSec Governance Specialist

DescriptionKforce has a client in NYC that is seeking an InfoSec Governance Specialist.Key Responsibilities:* Design and govern AWS IAM controls across users, services, and workloads, including roles, trust policies, permission boundaries, SCPs, STS/AssumeRole, cross-account access, and least-privilege models* Evaluate end-to-end identity and authentication flows using OAuth 2.0, OIDC, JWT, token exchange, delegation, and on-behalf-of patterns to ensure user identity and authorization are maintained across services and data* Govern Amazon EKS workload identity, including IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, namespaces, and workload permissions* Assess AWS cloud and network security, including PrivateLink, VPC endpoints, endpoint policies, security groups, segmentation, EKS posture, workload isolation, and container security* Manage security standards around AWS KMS and Secrets Manager, including encryption, key policies, secrets access, key separation, and credential protection* Establish data classification, entitlement, and authorization models that enforce least-privilege access to sensitive and regulated data* Strengthen software supply chain security through SBOMs, image signing/verification, ECR scanning, vulnerability management, and controls preventing untrusted artifacts from deployment* Use GuardDuty, Security Hub, and AWS Config to identify risks, configuration drift, and policy violations while helping automate security guardrails and remediation* Conduct practical threat modeling across identities, APIs, workloads, networks, and data, identifying risks such as privilege escalation, credential theft, unauthorized access, and compromised workloads* Partner closely with engineering and architecture teams to translate security and governance requirements into practical, scalable technical controlsRequirements* Experience securing Kubernetes environments, ideally Amazon EKS.* Understanding of IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, and workload identity* Experience with AWS KMS and Secrets Manager* Knowledge of AWS networking and private access patterns, including VPCs, PrivateLink, VPC endpoints, endpoint policies, and security groups* Experience with container security and software supply chain controls, including SBOMs, image signing, vulnerability scanning, and Amazon ECR* Experience with GuardDuty, Security Hub, and AWS Config* Strong understanding of data classification, authorization, entitlement design, and least-privilege principles* Ability to conduct practical threat modeling and translate identified risks into implementable technical controls* Experience operating in a financial services or similarly highly regulated environmentStrong hands-on knowledge of AWS security and IAM, including:* IAM roles and policies* Trust policies* Permission boundaries* Service Control Policies* STS/AssumeRole* Cross-account authorizationStrong understanding of modern authentication and authorization, including:* OAuth 2.0* OpenID Connect* JWT* Token exchange* Delegated/on-behalf-of authenticationPreferred:* Experience securing cloud-native data or AI platforms* Familiarity with CI/CD security and automated security controls* Understanding of infrastructure-as-code security and cloud configuration management* Experience working with enterprise-scale AWS environments involving multiple accounts and centralized security governance* Familiarity with financial-services security and regulatory expectations and frameworks such as NIST CSF, NIST 800-53, CIS Benchmarks, SOC 2, PCI DSS, or FFIEC guidance, where applicable* Experience translating security policies into technical guardrails and automated controlsJob TypeContractCompensation60 - $70