Cyber Security Staff Engineer - AWS Cloud

Partner closely with the Cloud Architecture and Engineering teams to audit the current AWS environment, identify security technical debt, and plan the refactoring of legacy resources into secure Terraform code. Design, deploy, tune, and maintain AWS WAF policies and rulesets to proactively protect corporate applications and APIs against application-layer attacks.

What you'll do

• Partner closely with the existing Cloud Architecture and Engineering teams to audit the current AWS environment, identify security technical debt, and plan the refactoring of legacy resources into secure Terraform code.
• Design, deploy, tune, and maintain AWS WAF (Web Application Firewall) policies and rulesets to proactively protect corporate applications and APIs against application-layer attacks (OWASP Top 10, bots, and zero-day exploits).
• Establish and enforce cloud security guardrails, multi-account structures (AWS Organizations/Control Tower), and Service Control Policies (SCPs) in collaboration with the infrastructure team.
• Help define and audit AWS Identity and Access Management (IAM) strategies, guiding engineering teams to transition from over-privileged legacy roles toward the principle of least privilege.
• Manage and optimize cloud-native security monitoring and detection tools (AWS Security Hub, GuardDuty, CloudTrail, Inspector, or KMS).
• Help on the incident response for AWS-specific security alerts, performing cloud forensic analysis and coordinating containment strategies.
• Ensure the AWS cloud ecosystem remains fully compliant with relevant financial regulations, internal policies, and security frameworks (NIST, CIS, BaFin requirements).

What you'll need

• A degree in Computer Science, Cloud Computing, Cyber Security, Information Technology, or equivalent professional experience.
• 5+ years of dedicated professional experience in Cloud Security Engineering, with a proven track record of securing complex AWS environments.
• Deep hands-on experience designing, implementing, and fine-tuning AWS WAF, AWS Shield, and CloudFront to protect public-facing application endpoints.
• Strong proficiency in Terraform and auditing IaC templates for security drifts.
• Mastery of AWS native security tools (IAM, KMS, Security Hub, GuardDuty) and multi-account security architecture.
• Business proficient written and spoken English.

Nice to have

• AWS Certified Security - Specialty or AWS Certified Solutions Architect (Associate/Professional).
• Experience working alongside Cloud Architecture or DevOps teams, acting as a security consultant.
• Understanding of AWS native AI capabilities (Bedrock or QuickSight).

What they offer

• Learning & development budget of €1000 per year with transparent growth framework.
• Competitive salary and variable remuneration program.
• Home office budget, monthly meal allowance, Deutschland ticket subsidy.
• 28 vacation days, increasing by 2 days after 2 years and 3 days after 3 years.
• Opportunity to work abroad for up to 12 weeks per year.