AWS Security Delivery Consultant with Migration & Modernization

Role purpose

Embed in an AWS migration or modernization team and own the practical implementation and validation of security controls for in-scope applications.

This is a delivery role: the successful candidate must turn security findings into working controls, documented decisions and an operational handoff.

What the person will deliver

• Document the current security posture, sensitive-data flows and material gaps for each assigned application before migration or modernization.
• Complete streamlined security reviews and maintain STRIDE-based threat models as designs change.
• Define security controls in the application Deployment Design Document and implement preventive and detective controls through CloudFormation, CDK or Terraform.
• Validate least-privilege IAM, Amazon Connect security profiles where applicable, network isolation, encryption, PII handling, logging and alerting.
• Track findings to closure, validate remediation evidence and coordinate unresolved risks through customer and AWS risk-management processes.
• Produce a clear security and compliance handoff covering implemented controls, exceptions, owners, monitoring and remaining actions.

What the ideal candidate must have to succeed

• Hands-on AWS and application-security delivery experience
• Working knowledge of IAM, KMS, network controls, logging and AWS security services
• IaC delivery using CloudFormation, CDK or Terraform
• Experience with AWS Organizations, SCPs or Control Tower in multi-account environments
• Ability to map technical controls to PCI DSS, ISO 27001, HIPAA or NIST requirements
• Clear written communication with technical leads, delivery teams and risk stakeholders
• Certification requirement: Must hold the AWS Certified Security - Specialty certification or be ready to obtain it within four weeks of hire.

Preferred:

• AWS Solutions Architect – Professional certification
• Container or serverless security experience
• Scripting in Python, Java or Bash
• Automated remediation using EventBridge, Lambda or Security Hub.