AWS Security AWS Cloud Security Architect/Remote

AWS Security AWS Cloud Security Architect/Remote

AWS Security AWS Cloud Security Architect – Landing Zone & Cyber Resilience/Remote

Remote

Duration: Long term

Required:

Alternates depending on seniority/framing: Sr. Cloud Security Engineer – IRE/Clean Room,

Principal Security Architect – AWS Multi-Account, or Cloud Infrastructure Security Architect

(EKS + Governance).

Scope

Multi-account AWS architecture design, AWS Organizations, and landing zone governance

Security Lab foundation and account vending design

Isolated Recovery Environment (IRE) architecture: WORM vault, cross-account backup,

recovery orchestration, Clean Room forensic environment

Amazon EKS baseline and lab environment for testing security capabilities

Key Responsibilities

WS-1: AWS Security Agent cloud infrastructure design and implementation support

WS-2 : (Security Lab): Design multi-account lab foundation, centralized logging (CloudTrail,

VPC Flow Logs, Config), OU structure, SCPs, and automated account vending

WS-3 (IRE & Clean Room): Design IRE account with WORM vault locking, crossaccount/

cross-region backup (3-2-1), CMKs, CyberArk break-glass, Macie integration,

Network Firewall, Transit Gateway route isolation, and recovery orchestration

WS-5: Design and implement Amazon EKS infrastructure configuration and the security lab

environment

Design Backup Audit Manager compliance framework

Design Route 53 DNS isolation and hardened compute baselines

Implement hardened compute baselines and secrets management

Author IRE & Clean Room Architecture & Design Document and Security Lab Architecture

Document

Contribute to lab operations guide and account vending admin procedures