Job Description
ABOUT THE ROLE
n

nWe are hiring a senior, hands-on engineer for a fixed 5 to 6 week, full time, remote contract to deliver two pieces of infrastructure on AWS: a hardened security baseline across our account, and a sealed development environment where source code never leaves the cloud.
n

nThis is a delivery role, not an advisory one. A week-by-week plan already exists. You will personally build and configure everything below, deliver it in Terraform, document it, and hand it over.
n

nWHAT YOU WILL BUILD
n

nWorkstream A: AWS security baseline
n- Enable and tune CloudTrail, GuardDuty, AWS Config, Security Hub, Amazon Inspector and IAM Access Analyzer.
n- Enforce MFA and an IAM password policy; review IAM users and roles for least privilege.
n- Tighten security groups across the estate and move all administrative access to SSM Session Manager, so no SSH or RDP is reachable from the internet.
n- Lock down S3 and database access; enable encryption at rest for EBS and RDS.
n- Set up centralised patching with SSM Patch Manager and backups with AWS Backup.




n- Configure security alerting with CloudWatch alarms and SNS.
n

nWorkstream B: Sealed Development Environment
n- Build an isolated dev VPC with default-deny egress using AWS Network Firewall.
n- Deploy Amazon WorkSpaces virtual desktops with DLP controls: clipboard, local drive, USB and printing redirection disabled.
n- Configure GitHub so repository access (web, git, API) is only possible from inside the dev environment: SSO, IP allow list, hardened org policies. This part is well documented; prior GitHub Enterprise admin experience is not required.
n- Set up AWS CodeArtifact as a package pull-through cache and self-hosted GitHub Actions runners inside the enclave.
n- Run a data-loss-prevention test matrix to prove code cannot leave; pilot with a small group, then roll out to all developers.
n

nCross-cutting
n- Everything as infrastructure as code in Terraform.
n- Runbooks

📌 Cloud Security (Tirunelveli)
🏢 Highbrow Technology
📍 Tirunelveli