About us:
Erbis is a thriving tech powerhouse where innovation meets opportunity. We specialize in building cutting-edge software solutions that drive success for businesses worldwide. At Erbis, we don't just develop software. We create impact. And to do that, we need the best talent in the industry. That's where you come in.
About the role:
An Erbis customer runs a supply chain and shipment management platform on AWS for enterprise shippers. Reporting to the CTO, you will own the security of our AWS platform end to end: detection, incident response, identity and access, vulnerability management, and the evidence our customers and auditors ask for.
You will have a prioritized roadmap, executive backing and room to build. Our infrastructure is in Terraform, and DevOps and development teams will act on your findings. We work AI-first: you will use Claude Code daily to write infrastructure code, scripts, queries and runbooks, and to build carefully guarded AI triage agents.
What you will do:
- Security architecture: multi-account AWS Organizations setup with an organization-wide CloudTrail and log archive, delegated GuardDuty, Security Hub and Config, and service control policies.
- Detection and response: threat detection and high-risk change alerting across all accounts and regions; alert triage, the security on-call and incident response.
- Vulnerability management: Security Hub, Inspector and SonarQube findings routed to tickets, a weekly review, and patch plans agreed with DevOps.
- Identity and access: short-lived, role-based credentials for people and automation; privileged access reviews across IAM Identity Center and Keycloak; Keycloak hardening.
- Resilience: incident runbooks, tabletop exercises and tested backup restores, including ransomware scenarios.
- Network and data protection: DNS filtering, secrets management, encryption in transit and at rest, a minimal external attack surface.
- Assurance: quarterly external penetration tests; customer security questionnaires and audits; AWS partner reviews (Well-Architected, Foundational Technical Review).
- Secure change: security review of infrastructure and application changes; policies kept current.
- AI-assisted security operations: triage agents you build and tune, with humans approving every action they propose.
Requirements:
- 6+ years in security or infrastructure engineering, with at least 3 years hands-on securing production AWS environments.
- You work autonomously: you set priorities, make the call and see it through.
- Deep AWS security: IAM and Organizations (SCPs, Identity Center, cross-account roles), CloudTrail, GuardDuty, Security Hub, Config, Inspector, KMS, Secrets Manager, VPC and network controls.
- Infrastructure as code: you write and review production Terraform.
- Scripting in Python or Bash for automation and investigations.
- Incident response: you have led real incidents from first alert through containment and post-mortem.
- Identity and access: SSO, MFA, least privilege, access reviews. Keycloak or another OIDC/SAML provider.
- Compliance: you have produced evidence for SOC 2, ISO 27001 or similar, and answered enterprise customers' security questionnaires.
- You explain risk plainly to engineers and executives. You get fixes done through other teams, without authority over them.
- Fluent written English.
Nice to have:
- Hands-on use of AI coding agents (Claude Code or similar) for security engineering, and an understanding of prompt-injection risks.
- Claude Certified Developer or Architect, or a similar AI coding certification.
- AWS Certified Security – Specialty, or OSCP, GCIH, CISSP.
- Application security: OWASP Top 10, SAST/DAST, working with external penetration testers.
- Java application stacks, PostgreSQL, Oracle or Redshift.
- GDPR and data-protection work in a B2B SaaS.
- Supply chain, logistics or other B2B SaaS background.
Our perks and benefits:
- Paid Vacation days: 24 working days
- Paid Sick days: 15 working days
- The opportunity to dedicate up to 10% of working hours for self-education and personal development
- BYOD program (Bring Your Own Device)