Security Engineer, Saronic

• 6+ years of hands-on experience in cloud security engineering, infrastructure security, DevSecOps, or a closely related security engineering role
• Expert-level proficiency with Terraform, including module design, state management, policy-as-code, and managing complex multi-environment configurations
• Deep expertise in AWS security services and architecture, including IAM, Organizations, SCPs, Control Tower, CloudTrail, Config, GuardDuty, Security Hub, KMS, and VPC security
• Demonstrated experience building security guardrails and reusable infrastructure patterns that engineering teams adopt without friction
• Strong experience with CI/CD pipeline security, IaC review processes, and automated compliance validation
• Experience operating in AWS GovCloud or FedRAMP-regulated cloud environments
• Strong proficiency in Python, Go, Rust, or equivalent languages for building security automation and tooling
• Ability to obtain and maintain a security clearance

Desirable

• Security at Saronic is a force multiplier
• We're seeking a Security Engineer at the senior-level or above to own the design, implementation, and continuous improvement of security guardrails across our cloud infrastructure
• You won't just secure the cloud; you'll build the systems and patterns that enable every team at Saronic to move fast and ship with confidence, with security baked in from the start
• You will be the technical authority on how we architect, govern, and defend our AWS environments across commercial and GovCloud
• Own the security architecture for Saronic's AWS environments, including multi-account strategy, network segmentation, identity architecture, and data protection across commercial AWS and AWS GovCloud
• Design and maintain secure-by-default Terraform modules and IaC standards that teams adopt as the standard path, enforcing least privilege, secure defaults, and compliance requirements
• Implement preventive controls (SCPs, permission boundaries, policy-as-code) and detective controls (Config rules, CloudTrail analysis, GuardDuty) as a unified, layered security model
• Design and enforce IAM patterns across AWS accounts, services, and workloads including least-privilege policies, permission boundaries, cross-account access, federation, and service-to-service authentication
• Implement and govern secrets management using tools such as AWS Secrets Manager or Vault, integrated into CI/CD and runtime environments
• Partner with DevOps and Platform Engineering to embed security into CI/CD pipelines, infrastructure provisioning, and deployment workflows
• Build automated compliance validation into infrastructure pipelines and replace manual security gates with automated guardrails wherever possible
• Create self-service security tooling and patterns that allow teams to operate with speed and autonomy while maintaining compliance
• Integrate logging, monitoring, and alerting across cloud infrastructure to validate control effectiveness and detect misconfigurations or threats
• Build and tune cloud-native detections using CloudTrail, GuardDuty, Config, and SIEM integrations
• Support incident response for cloud security events, drive root-cause analysis, and translate findings into improved guardrails and controls