Cloud Security Engineer

About the position

LightFeather is seeking a Cloud Security Engineer to join our team in Washington DC. The ideal candidate will have hands-on experience designing and securing AWS environments in compliance with federal regulations. You’ll play a critical role in maintaining the integrity, confidentiality, and availability of our cloud infrastructure by embedding security best practices at every layer—from architecture and automation to compliance and monitoring.

Responsibilities

• Design, implement, and maintain secure AWS architectures compliant with federal security frameworks (FedRAMP, FISMA, NIST 800-53).
• Ensure security best practices are incorporated into cloud architecture and infrastructure solutions.
• Manage IAM roles, policies, federated access controls, and enforce least privilege principles.
• Configure and continuously monitor AWS-native security tools such as GuardDuty, CloudTrail, Security Hub, Macie, and Inspector.
• Set up comprehensive monitoring and logging solutions (e.g., Amazon CloudWatch, AWS CloudTrail) to track activities and support incident detection.
• Respond to security incidents, conduct forensic investigations, and implement corrective actions.
• Conduct risk assessments, vulnerability assessments, audits, and penetration testing to identify and remediate security gaps.
• Ensure compliance with federal and industry standards such as GDPR, HIPAA, and PCI-DSS.
• Implement and manage encryption and key management solutions (e.g., AWS KMS) to safeguard sensitive data.
• Ensure secure backup and recovery processes are in place and regularly validated.
• Develop and enforce cloud security policies, standards, and baselines aligned with organizational and regulatory requirements.
• Integrate security controls into Infrastructure as Code (IaC) tools like Terraform and CloudFormation.
• Conduct security reviews of IaC templates and remediate misconfigurations.
• Embed security into CI/CD pipelines, utilizing automation tools like GitLab CI/CD, Jenkins, Azure DevOps, SonarQube, and Terraform.
• Collaborate with development and DevOps teams to ensure secure software development lifecycle processes.
• Manage AWS accounts and implement SSO solutions to streamline and consolidate access across environments.
• Utilize Prometheus and Grafana for EKS (Kubernetes) monitoring to ensure high availability of microservices.
• Create and maintain critical operating systems, communications software, and utility programs.
• Manage file systems including logical volumes, network file systems (NFS), encryption, and patching of OS and software packages.
• Support the preparation of ATO documentation and assist with security audits and continuous monitoring.
• Maintain thorough documentation, audit trails, and compliance evidence.

Requirements

• U.S. Citizenship.
• Active Top Secret clearance.
• Bachelor’s degree in Computer Science, Cyber Security, Information Systems, or a related field.
• 5+ years experience in cloud security and cybersecurity, with a strong understanding of AWS services and their security capabilities.
• Demonstrated experience designing and implementing secure cloud solutions on AWS.
• Experience managing IAM roles, policies, SSO integrations, and applying least privilege access principles.
• Hands-on experience with AWS-native security tools such as GuardDuty, CloudTrail, Security Hub, Macie, and Inspector.
• Familiarity with risk assessments, vulnerability scanning, and penetration testing.
• Experience with industry regulations and standards including GDPR, HIPAA, PCI-DSS, FedRAMP, FISMA, and NIST 800-53.
• Proficiency with Infrastructure as Code tools: Terraform, CloudFormation.
• Experience integrating security in CI/CD pipelines using tools such as GitLab CI/CD, Jenkins, Azure DevOps, SonarQube, and GitHub.
• Strong background in monitoring and alerting (e.g., Prometheus, Grafana) and Kubernetes (EKS) environments.
• Experience with backup/recovery practices, encryption, and AWS key management (KMS).
• Solid understanding of systems administration including OS patching, file systems, and network permissions.
• Excellent communication and documentation skills for audit and compliance reporting.

Nice-to-haves

• AWS Security Specialty Certification or similar credentials.
• Experience in a cloud-first government or defense environment.
• Exposure to automated security testing tools and static code analysis.