Cloud Security Engineer

Cross-Account Access

Why: You can design the trust model across dozens of accounts, limiting assume-role chains and blast radius so one compromised account cannot reach the rest.

Service Control Policies (SCPs)

Why: You can write an SCP or organisation policy that blocks disabling CloudTrail or using unapproved regions for every account, and roll it out without stopping legitimate work.

Encryption at Rest & Transit

Why: You can define the key hierarchy and rotation policy for the organisation, including who administers keys versus who uses them, and handle an HSM or mutual TLS requirement.

VPC Security Architecture

Why: You can design a VPC layout with private subnets, endpoints and flow-log analysis so workloads reach AWS services without crossing the internet and data exfiltration is visible.

Security Hub / Defender / SCC

Why: You can aggregate findings from every account into one delegated admin view, define the posture score the business tracks and decide which controls are mandatory.

Misconfiguration Detection

Why: You can build the preventive and detective layers together, so IaC scans block new drift while Config and Prowler catch changes made by hand in the console.

Image Scanning & Hardening

Why: You can set an organisation-wide image policy, such as approved base images and a fail threshold, and handle the exceptions teams request for legacy workloads.

Runtime Security (Falco/Sysdig)

Why: You can roll out runtime detection across many clusters and decide how alerts feed incident response, so a container escape attempt reaches a human within minutes.

CloudTrail / Activity Log Analysis

Why: You can centralise audit logs in a protected account with retention rules, and build the queries that reconstruct an intruder's path across accounts during an investigation.

Threat Detection (GuardDuty/Sentinel)

Why: You can decide which detections to enable and how to route them, and write the response playbook for a compromised instance so the on-call team acts consistently.

Compliance as Code

Why: You can build the shared policy library that every team consumes in CI/CD, with a clear exception process, so compliance is enforced the same way everywhere.

SOC 2 / HIPAA / PCI-DSS Automation

Why: You can map controls to SOC 2, HIPAA or PCI-DSS requirements and automate evidence collection, so an auditor's request is answered from reports rather than screenshots.