Role & responsibilities

Responsibilities

- Build, test and promote event-driven compliance and remediation rules across AWS accounts. Rules start in detect-only mode and move to enforcement.
- Enable and verify automated remediation for existing guardrails, one guardrail at a time, without breaking running workloads.
- Upgrade legacy governance configuration once replacement rules are proven.
- Build alerting for platform-health risks, such as Lambda functions on runtimes approaching end of life, and publish it to dashboards, typically by integrating AWS to Grafana.
- Carry out cloud-hygiene tasks: retiring unused SAML identity providers, reviewing security groups, applying log-retention policies.
- Build secure-by-default Terraform modules and CloudFormation templates that development teams can reuse.
- Document every guardrail and write runbooks and change records to the team's standard.
- Work in our Jira and GitLab workflow and take part in code review.

Must-have:

Skill

Detail

AWS security, IAM and Organizations (primary requirement, expert level)

IAM: policy evaluation logic across identity, resource and session policies, permission boundaries and SCPs; cross-account role and trust design; SAML federation; IAM Access Analyzer. Organizations: OU design,



Service Control Policies, delegated administration, organization-wide CloudTrail and AWS Config. Security services: GuardDuty, Security Hub, AWS Config, CloudTrail, KMS, AWS WAF managed rule groups

AWS, multi-account

VPC and CloudWAN, EventBridge

Policy-as-code

Production experience with both Cloud Custodian and AWS Config rules, including remediation

Event-driven AWS

CloudTrail, EventBridge and Lambda

Terraform and CloudFormation

Writes and maintains Terraform modules and CloudFormation templates, not only runs them

SSO

SAML SSO integration

Images and configuration

Packer image pipelines and Puppet configuration management

Python and NodeJS

Production Lambda code, with tests

CI/CD

GitLab CI multi-environment promotion pipelines, Git workflow

Communication

Robust communications skills

Nice-to-have

- Azure
- GCP
- OPA or similar policy checks in CI
- Grafana alerting and dashboards
- Okta as the SAML identity provider, SAML in general
- Cloudflare (Terraform provider, Logpush)
- AWS certifications: DevOps Engineer Professional, Security – Specialty or Solutions Architect – Professional

📌 Aws Devops Engineer (Pune)
🏢 Spectrum Talent Management
📍 Pune