Cyber Cloud Solution Engineer Lead/Staff

AEP Service Corporation is seeking an Advanced Cloud Security Engineer to engineer, implement, and monitor security guardrails across AWS and other cloud environments. The role focuses on cloud security controls, infrastructure and policy as code, SSE platform management, and collaboration on incident response and threat hunting.

Responsibilities:

• AWS Security Engineering: Design, build, and maintain enterprise-grade security controls utilizing third party SSE and native AWS security services
• Multi-Cloud Support: Provide primary to AWS / secondary security engineering, posture management, and threat detection support for Azure, GCP, and OCI environments
• DevSecOps & Automation: Work with our Cloud Engineering group to help operationalize Infrastructure as Code (IaC) and Policy as Code (PaC) to automate security guardrails, vulnerability scanning, and compliance checks
• SSE Management: Architect and maintain policies within the third party SSE platform to protect corporate data and govern cloud applications across our primary cloud environments
• Incident Response & Threat Hunting: Partner with our SOC to investigate cloud-specific security incidents, develop automated remediation playbooks, and conduct threat-modeling exercises

Requirements:

• Comprehensive understanding of AWS security services, including but not limited to: AWS IAM (complex policies, permission boundaries, organizations), AWS GuardDuty, AWS Security Hub, AWS Config, AWS CloudTrail, KMS, Macie, and Network Firewall
• Functional technical competency and architectural understanding of security controls in Azure (Entra ID, Microsoft Defender for Cloud), GCP (Security Command Center, IAM), and OCI (Identity and Access Management, Cloud Guard)
• Strong proficiency in IaC tools (specifically Terraform or AWS CloudFormation) and a deep understanding of PaC frameworks (such as Open Policy Agent/Rego, AWS CloudFormation Guard, or HashiCorp Sentinel) to enforce compliance before deployment
• Foundational understanding of cloud routing, VPC/VNet peering, CASB (Cloud Access Security Broker), Secure Web Gateway (SWG), and Zero Trust Network Access (ZTNA) concepts
• Bachelor's degree in computer science, engineering, or related technical field is required
• 8 years of relevant work experience is required. An equivalent combination of education and related experience may be considered
• 10 years of relevant work experience is required. An equivalent combination of education and related experience may be considered
• Direct, hands-on experience configuring, tuning, and deploying a SASE/SSE platform (CASB, SWG, DLP) across AWS, Azure, and GCP
• Proven track record of building automated compliance pipelines that block non-compliant code and infrastructure from being merged into production
• Experience shifting organizations from reactive security monitoring to proactive cloud security posture management (CSPM) and continuous compliance
• AWS Certified Security – Specialty
• AWS Certified Solutions Architect – Professional
• CCSP (Certified Cloud Security Professional) / CISSP
• Other AWS, Microsoft Azure, Google Cloud Platform, or Oracle Cloud Infrastructure certifications
• CCIPS, CCSP, CERT Incident Response Process Professional
• CISM, CISSP, CNDA, CNPS
• GIAC Certifications (e.g., GCIH, GCIP, GSEC, GREM)
• Other vendor-specific cloud certifications