AWS Cloud Security Engineer

About the role

ON.energy is looking for an experienced AWS Cloud Security Engineer to design, implement, and operate a multi‑account security foundation that protects both data‑center assets and the electrical grid. You will work closely with IT, OT, and engineering teams to secure cloud‑to‑site connectivity, enforce identity controls, and build automated detection and response capabilities.

Key responsibilities

• Define and maintain the AWS Organizations structure, SCPs, guardrails, centralized logging, and secure baselines as infrastructure‑as‑code.
• Implement IAM Identity Center with Microsoft Entra ID federation, role‑based access models, privileged and break‑glass access, and recurring access reviews.
• Design and defend site‑to‑cloud VPN, private connectivity, and segmentation between IT and OT zones, including certificate management for field gateways.
• Develop and tune threat detection using GuardDuty, Security Hub, Detective, Inspector, Config, and CloudTrail, mapping detections to MITRE ATT&CK frameworks.
• Lead vulnerability management across workloads, container images, and dependencies, driving remediation SLAs and reporting.

Required profile

• 5+ years of hands‑on cloud security, security‑focused infrastructure, or cloud operations experience, primarily on AWS.
• Proven ability to walk an intrusion path end‑to‑end and design detections, containment, and remediation.
• Deep knowledge of hybrid network security: segmentation, VPN, private connectivity, routing, DNS, CIDR, and subnetting.
• Strong expertise with AWS native security services and infrastructure‑as‑code tools (CDK, CloudFormation, Terraform).
• Advanced English (B2‑C1) for daily collaboration and documentation.

Required skills

• AWS (IAM, Organizations, GuardDuty, Security Hub, Detective, Inspector, Config, CloudTrail, KMS, WAF)
• Infrastructure as code: CDK, CloudFormation, Terraform
• Network security: VPN, private connectivity, DNS, CIDR, subnetting
• Identity federation: Microsoft Entra ID, IAM Identity Center
• OT/ICS protocols: Modbus, DNP3, OPC UA, MQTT; familiarity with IEC 62443 or NIST SP 800‑82

What we offer

• Competitive salary with performance‑based bonus eligibility
• Medical, dental, and vision insurance (US) or major medical and life insurance (Mexico)
• Retirement plan with company match (401(k) in US)
• Paid time off, holidays and, for Mexico, a 30‑day Christmas bonus (Aguinaldo)
• Professional development, growth opportunities, and a mission‑driven team shaping clean‑energy infrastructure