Cloud Security Engineer

Cross-Account Access

Vì sao: You can design the trust model across dozens of accounts, limiting assume-role chains and blast radius so one compromised account cannot reach the rest.

Service Control Policies (SCPs)

Vì sao: You can write an SCP or organisation policy that blocks disabling CloudTrail or using unapproved regions for every account, and roll it out without stopping legitimate work.

Encryption at Rest & Transit

Vì sao: You can define the key hierarchy and rotation policy for the organisation, including who administers keys versus who uses them, and handle an HSM or mutual TLS requirement.

VPC Security Architecture

Vì sao: You can design a VPC layout with private subnets, endpoints and flow-log analysis so workloads reach AWS services without crossing the internet and data exfiltration is visible.

Security Hub / Defender / SCC

Vì sao: You can aggregate findings from every account into one delegated admin view, define the posture score the business tracks and decide which controls are mandatory.

Misconfiguration Detection

Vì sao: You can build the preventive and detective layers together, so IaC scans block new drift while Config and Prowler catch changes made by hand in the console.

Image Scanning & Hardening

Vì sao: You can set an organisation-wide image policy, such as approved base images and a fail threshold, and handle the exceptions teams request for legacy workloads.

Runtime Security (Falco/Sysdig)

Vì sao: You can roll out runtime detection across many clusters and decide how alerts feed incident response, so a container escape attempt reaches a human within minutes.

CloudTrail / Activity Log Analysis

Vì sao: You can centralise audit logs in a protected account with retention rules, and build the queries that reconstruct an intruder's path across accounts during an investigation.

Threat Detection (GuardDuty/Sentinel)

Vì sao: You can decide which detections to enable and how to route them, and write the response playbook for a compromised instance so the on-call team acts consistently.

Compliance as Code

Vì sao: You can build the shared policy library that every team consumes in CI/CD, with a clear exception process, so compliance is enforced the same way everywhere.

SOC 2 / HIPAA / PCI-DSS Automation

Vì sao: You can map controls to SOC 2, HIPAA or PCI-DSS requirements and automate evidence collection, so an auditor's request is answered from reports rather than screenshots.