Cloud Security Engineer (AWS & Azure)

About the role

The Cloud Security Engineer secures Avrioc's cloud-native infrastructure, applications and workloads hosted on AWS and Azure. The role designs and enforces proactive security controls across the full cloud stack, monitors and responds to threats, integrates security into CI/CD pipelines and manages firewall and perimeter defenses using AWS and Azure native and third-party tooling.

Key responsibilities

• Design, implement and manage secure cloud architectures on AWS and Azure, following best practices, security frameworks and enterprise governance standards.
• Manage AWS Control Tower and Landing Zone Accelerator environments, including SCPs, Guardrails, AWS Config Rules and AWS Organizations.
• Design Azure Landing Zones, Management Groups, Azure Policy, Azure Blueprints and governance frameworks.
• Configure cloud-native security services such as AWS GuardDuty, Security Hub, Inspector, Macie, IAM Access Analyzer, WAF, Shield, Firewall Manager, KMS and Secrets Manager, and Azure Defender for Cloud, Sentinel, Azure Firewall, DDoS Protection, Key Vault, Entra ID and Defender for Identity.
• Define monitoring, alert triage, incident response, ticketing and remediation processes via SIEM/SOAR (Sentinel, Elastic SIEM, Defender XDR) and ITSM (Jira, ServiceNow).
• Provision infrastructure hands-on with Terraform, CloudFormation, ARM templates or Bicep, and integrate security scanning, policy validation and misconfiguration detection into CI/CD pipelines.
• Investigate incidents, perform forensics and root cause analysis, and carry out vulnerability management across VMs, containers, Kubernetes, serverless workloads, storage, databases and applications.
• Secure cloud identity and access with IAM, Entra ID, PIM, RBAC, Conditional Access, MFA and Zero Trust principles.
• Secure networking components such as VPC/VNet, Security Groups, NSGs, NACLs, Transit Gateway, Virtual WAN, Private Link, VPN, ExpressRoute and load balancers.
• Maintain security dashboards, KPIs/KRIs, runbooks, architecture diagrams, compliance reports and SOPs.

Required profile

• Preferred certifications: AWS Certified Security – Specialty, AZ-500, CCSP, GCSA, CKS/CKA, CISSP or other cloud security credentials.

Required skills

• AWS and Azure security services and landing zones
• Sentinel, Elastic SIEM, Defender XDR, Jira, ServiceNow
• Terraform, CloudFormation, ARM templates or Bicep
• IaC security scanning and CI/CD integration
• Vulnerability management and incident investigation