Join Tech company's Cyber Security Operations team, where you’ll play an active role in safeguarding the company’s digital landscape. As a member of this dynamic group, you’ll be responsible for implementing, monitoring, and enhancing essential security controls. Your work will include drafting clear security policies, standards, and guidelines, as well as driving organizational security awareness. If you’re passionate about protecting information and shaping a resilient security environment, this team offers the perfect opportunity to make a tangible impact.
What You'll Do
Cloud Security & Infrastructure Hardening
- Own security for large-scale AWS environments, including IAM, S3, CloudTrail, GuardDuty, VPC, EC2, and API Gateway.
- Implement automated security scanning using tools like ScoutSuite, Prowler, Nuclei, and custom scanners.
- Architect and secure EKS clusters and core components.
- Design and manage secure networking models and ZTNA access patterns.
CI/CD & DevSecOps Enablement
- Build and secure CI/CD pipelines in GitHub Actions and ArgoCD.
- Drive "shift-left security" using automated linting, IaC scanning, container scanning, and pipeline enforcement.
- Lead implementation of internal LLM access infrastructure.
Automation & Security Engineering
- Develop automation for access approvals, incident response, Just-In-Time access, log retention, and cloud hygiene.
- Build event-driven security pipelines using Terraform, Kubernetes, cronjobs, Lambda, and API-based workflows.
- Implement and manage SIEM integrations, including detections, log parsing, enrichment, and monitoring.
Identity, Access, and Zero Trust
- Manage and enhance identity & access systems using IdP, SSO/SAML federation, group automation, and role-based access for AWS environments.
- Develop automated processes to detect user inactivity, behavioral anomalies, and account misuse.
Threat Detection, Incident Response & DFIR
- Lead full lifecycle incident response across AWS, Kubernetes, identity systems, and SaaS platforms.
- Develop playbooks, response procedures, and automated remediation pipelines.
- Build and refine detection logic within SIEM, including correlation rules, enrichment, and false-positive tuning.
- Lead threat hunting operations, using behavioral analytics, CloudTrail events, Identity logs, and API telemetry.
- Drive post-incident reviews, root cause analysis, and long-term security improvements.
- Simulate real attacks (LFI, RCE, reverse shells, privilege escalation, CVE exploitation, etc) to challenge and validate defenses
- Perform vulnerability discovery, PoC development, and exploitation testing to validate control effectiveness.
What We're Looking For
- 4+ years of experience in SecOps, DevSecOps, Cloud Security, or Security Engineering.
- Experience with implementing security practices for large-scale AWS environments
- Experience in designing and managing secure networking models and ZTNA access patterns
- Strong hands-on IR experience in cloud-native and distributed environments.
- Strong hands-on experience with AWS, Kubernetes/EKS, and Terraform.
- Deep understanding of identity and access management (IAM, RBAC, IdP, SSO, role federation).
- Experience with CI/CD pipelines, infrastructure-as-code, and GitOps (ArgoCD).
- Familiarity with cloud-native security tooling
- Understanding of exploit mechanics, malware behavior, and offensive security techniques
- Ability to build automations (Python, Bash, Power Automate, APIs).
- Strong knowledge of Linux internals, containers, and security best practices.
- Experience performing vulnerability analysis, exploitation testing, and API security assessment.
- Excellent communication skills and the ability to collaborate across engineering and security teams.