Security Engineer (App Dev)- onsite

AWS security / fundamentals
oDeep IAM fluency: least-privilege policy design, roles vs. users, permission boundaries, cross-account trust, and spotting over-privileged automation identities
oHands-on with the AWS security stack: GuardDuty, Security Hub, CloudTrail, Config, Inspector, KMS, Secrets Manager, VPC/network controls
oUnderstands the shared responsibility model and where the application s exposure actually sits (S3 policies, security groups, public endpoints, etc.)

Automation and infrastructure-as-code
oCan read and review Terraform/CloudFormation/CDK/etc, and knows how to put security checks into the pipeline (tfsec, Checkov, policy-as-code like OPA)
oComfortable auditing Lambda, Step Functions, EventBridge, and scheduled jobs for insecure defaults, secret sprawl, and excessive permissions
oTreats CI/CD as an attack surface: pipeline credentials, OIDC federation, artifact integrity, supply-chain risk

Secure engineering
oCan write production-quality code (Python, Go, or similar) and can build security tooling
oExperience with threat modeling for event-driven and service-to-service architectures, including non-human identities and machine-to-machine auth
oKnows application security basics: OWASP, auth/session handling, input validation, dependency and container scanning
oExperience setting up/running CSPM(s), policy tuning, etc

Detection and response
oCan design alerting from CloudTrail/VPC flow logs/application logs and has experience integration into SIEM platform(s)
oHas run or participated in incident response in a cloud environment and can automate containment steps

Working style
oPragmatic about risk: prioritizes by actual exploitability and blast radius
oCommunicates clearly with developers and explains the why so fixes stick
oIs comfortable documenting controls and work guidance documents to aid in awareness of achieving of a more secure control environment.
oMust be comfortable working and reporting to the Sr Director of Information Security, with a "dotted line" to the application team leadership.

Nice to have
oRelevant certs (AWS Security Specialty, OSCP, CKS)
oCompliance exposure (SOC 2, ISO 27001, FedRAMP) a plus
oFamiliarity with CSPM or cloud-native runtime security tools