Platform Security Engineer, AWS Serverless

The platform operates at serious scale:

• 6,000–7,000 AWS accounts
• Tens of thousands of Lambda functions
• API Gateway, EventBridge, SQS and other AWS-native services
• No EC2, Kubernetes or containers
• CDK and TypeScript

This is not an IAM administration or security operations role. You’ll design, code and own security systems used across a large serverless platform.

What you’ll build

• Security automation and automated remediation
• Guardrails across thousands of AWS accounts
• Secure-by-default infrastructure patterns
• Controls around GuardDuty, Config, CloudTrail and Security Hub
• AWS Organizations, Control Tower and SCP architecture
• Developer tooling that makes secure implementation easier
• Approaches to tenant isolation and least-privilege access
• Production systems for detecting and responding to security issues

You might be a fit if you

• Have built AWS security systems, not simply operated security tools
• Write production code and are comfortable owning what you deploy
• Understand AWS serverless architecture in depth
• Have worked with AWS Organizations, Control Tower or SCPs
• Have built automation using Lambda, EventBridge, SQS or Step Functions
• Can read and reason through CDK and TypeScript
• Have a software, infrastructure or platform engineering background
• Can identify important problems and drive solutions without a detailed roadmap

The team is small, technical and direct. You’ll have significant autonomy, but that comes with a high expectation of ownership.
If your recent work is primarily IAM administration, SOC operations, compliance, CSPM tooling or Kubernetes security, this probably isn’t the right role.

If you have built AWS security systems rather than just operated security tools, message me.