About the Project
Our client is an IT company seeking an experienced Cloud and Infrastructure Security Engineer to assess and strengthen the security posture of a complex, multi-cloud infrastructure. The client is building a dedicated security team for a US-based SaaS provider whose platform serves hundreds of public-sector agencies across North America. The programme covers a large, varied estate of around a dozen product lines, running on Java, .NET, Node/TypeScript, Ruby and PHP across Azure and AWS, including legacy systems that need framework upgrades rather than quick patches.
The work starts with a short phase where senior engineers do threat modelling and map the estate. A larger team then fixes vulnerabilities, hardens cloud infrastructure, builds security gates into CI/CD pipelines and consolidates identity services. Engineers work hands-on with modern AI coding tools and learn security from experienced tower leads. It's a strong fit for good software, cloud and DevOps engineers who want to grow into application security. The team works in English, with partial overlap with US Eastern time.
The project focuses on mapping the existing infrastructure attack surface, identifying security vulnerabilities and configuration gaps, and establishing a prioritized remediation roadmap. The engineer will work alongside other senior security specialists responsible for application security assessments, focusing specifically on cloud, edge, network, and virtual machine infrastructure.
Задачи (Responsibilities)
•Assess the Azure environment, including AKS with Istio, API Management, Application Gateway, Front Door, Azure Firewall, hub-and-spoke networking, and Key Vault.
•Review the AWS infrastructure supporting one product line, including ECS, EC2, Lambda, API Gateway, and VPC.
•Evaluate edge security across Cloudflare, Azure Front Door, and Application Gateway, covering WAF configurations, TLS, and security headers.
•Assess the VM estate, including 500+ SQL Server databases and legacy applications running on static VMs without infrastructure-as-code.
•Review infrastructure-as-code and configuration management practices using Terraform, OpenTofu, Ansible, and Chef.
•Define security hardening baselines and prioritize remediation activities for cloud and infrastructure engineering teams in the next project phase.
Требования (Requirements)
•Approximately 8+ years of experience in cloud or infrastructure engineering, with a strong background in security.
•Deep expertise in Azure security and practical working knowledge of AWS.
•Hands-on experience with Kubernetes security.
•Proficiency in Terraform or OpenTofu.
•Practical experience using AI assistants to review infrastructure code and configurations.
•Ability to identify infrastructure security risks and translate findings into actionable remediation priorities.
•Experience securing Istio service mesh environments.
•Ability to review Ansible and Chef configurations.
•Relevant certifications such as AZ-500, AWS Certified Security – Specialty, or CCSP.
•Experience with cloud security posture management tools such as Microsoft Defender for Cloud, Wiz, or similar.
•Previous experience securing and modernizing legacy infrastructure environments without established infrastructure-as-code practices.
Additional Info
•Location: Lithuania/Poland
•Start date: ASAP
•Contract duration: 12 months
