AWS Cloud Security Engineer

Job Number: R0247681

AWS Cloud Security Engineer

The Opportunity:

Organizations are expanding their use of AWS, but securing a large cloud environment requires more than deploying individual security tools. As an AWS cloud security engineer, you know how to assess how services are being used, establish secure configuration standards, build preventive guardrails, automate controls, and help engineering teams operate cloud environments consistently and securely.

As an AWS Cloud Security Engineer on our team, you'll support a hands-on AWS cloud security assessment and engineering program for a large enterprise environment. You'll help review AWS Organizations, accounts, landing zones, identity, networking, security services, workloads, policies, Infrastructure as Code, and existing security tooling to identify gaps and opportunities to strengthen the client's cloud security posture.

You'll work with AWS Organizations, IAM, IAM Identity Center, Service Control Policies, VPC networking, CloudTrail, Config, GuardDuty, Security Hub, KMS, Systems Manager, and other AWS-native services. You'll assist in establishing minimum secure configuration baselines for AWS services, developing reusable Terraform and Infrastructure as Code, creating security policies and guardrails, evaluating existing cloud security tooling, and developing implementation-ready technical documentation.

This is an opportunity to combine practical AWS engineering with cloud security architecture, automation, and client delivery. You'll work alongside experienced cloud architects and security engineers while collaborating directly with cloud platform teams, security stakeholders, application owners, governance teams, and client leadership.

You'll support work that includes AWS security assessments, landing zone reviews, identity and access management, network security, Secure copy protocol (SCP) development, secure service baselines, Infrastructure as Code, security automation, application architecture reviews, tooling optimization, and cloud governance. Your ability to translate technical requirements into scalable, repeatable engineering solutions will help clients strengthen cloud security while enabling continued adoption of AWS.

Join us. The world can't wait.

You Have:

• 3+ years of experience with AWS cloud engineering, cloud security, infrastructure engineering, DevSecOps, site reliability engineering, or enterprise cloud delivery

• Experience with AWS Organizations, organizational units, multi-account environments, IAM, roles, policies, Service Control Policies, or cross-account access

• Experience with AWS networking, including VPCs, subnets, security groups, routing, Transit Gateway, private connectivity, DNS, load balancing, or ingress and egress controls

• Experience with AWS security and monitoring services, including CloudTrail, AWS Config, GuardDuty, Security Hub, KMS, IAM Access Analyzer, CloudWatch, Systems Manager, or AWS Inspector

• Experience developing or reviewing Terraform, AWS CloudFormation, or Infrastructure as Code used to deploy and manage AWS resources

• Experience in assisting with developing cloud security standards, secure configuration baselines, technical guardrails, policies, or reusable security patterns

• Experience with scripting or automation using Python, Bash, PowerShell, AWS CLI, SDKs, APIs, or engineering tools

• Experience assessing technical environments, identifying security or architecture gaps, and translating findings into practical recommendations, implementation steps, or technical documentation

• Ability to work directly with cloud engineers, architects, cybersecurity teams, application teams, governance stakeholders, and client leadership

• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, or Information Systems

Nice If You Have:

• Experience with AWS IAM Identity Center, SAML, OIDC, permission sets, privileged access, enterprise federation, or identity governance

• Experience designing, reviewing, or supporting AWS landing zones, AWS Control Tower, account vending, centralized logging, shared services, or enterprise AWS platform architectures

• Experience in assisting with developing AWS Service Control Policies, IAM policies, resource policies, permission boundaries, or preventive cloud security controls

• Experience developing secure baselines and Infrastructure as Code for multiple AWS services in a large enterprise environment

• Experience with cloud security platforms such as Wiz, Prisma Cloud, Orca Security, Lacework, or other Cloud Security Posture Management (CSPM) or Cloud-Native Application Protection Platform (CNAPP) technologies

• Experience with integrating security requirements into CI/CD pipelines, Git workflows, DevSecOps processes, automated testing, or policy-as-code

• Experience with security frameworks or standards such as NIST, CIS Benchmarks, ISO 27001, FedRAMP, or cloud security control frameworks

• Experience reviewing application architectures, dependencies, and infrastructure components and identifying opportunities to use AWS-native services or cloud-native design patterns

• Experience supporting large enterprise, Fortune 500, regulated, or multi-account cloud environments

• Knowledge of Microsoft Azure or Google Cloud security

Compensation

At Booz Allen, we celebrate your contributions, provide you with opportunities and choices, and support your total well-being. Our offerings include health, life, disability, financial, and retirement benefits, as well as paid leave, professional development, tuition assistance, work-life programs, and dependent care. Our recognition awards program acknowledges employees for exceptional performance and superior demonstration of our values. Full-time and part-time employees working at least 20 hours a week on a regular basis are eligible to participate in Booz Allen's benefit programs. Individuals that do not meet the threshold are only eligible for select offerings, not inclusive of health benefits. We encourage you to learn more about our total benefits by visiting the Resource page on our Careers site and reviewing Our Employee Benefits page.

Salary at Booz Allen is determined by various factors, including but not limited to location, the individual's particular combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability and organizational requirements. The projected compensation range for this position is $69,300.00 to $158,000.00 (annualized USD). The estimate displayed represents the typical salary range for this position and is just one component of Booz Allen's total compensation package for employees. This posting will close within 90 days from the Posting Date.

Identity Statement

As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during interviews and assessments. We reserve the right to take your picture to verify your identity and prevent fraud.

Candidate AI Usage Policy

AI is a part of our daily work at Booz Allen, and we are committed to the responsible and ethical use of AI tools. However, we want to ensure a fair candidate process based on your own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) or other tools to assist with responses during interviews (whether in-person or virtual) is prohibited unless permission is explicitly provided .

Work Model
Our people-first culture prioritizes the benefits of collaboration. To support engagement and effective communication, employees working virtually are generally expected to have their cameras on during meetings.

• Remote : If this position is listed as remote, there may still be occasions when you are required to work in person at a Booz Allen or customer facility.
• Hybrid : If this position is listed as hybrid, you will be expected to work from a Booz Allen or customer facility, in alignment with your leadership's expectations and the needs of the role.
• Onsite : If this position is listed as onsite, work will primarily be performed full-time at a customer facility, where employees will collaborate directly with colleagues and customers as required by the role.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local, or international law.