The posting
About AllCloud
AllCloud is a leader in amplifying organizations’ cloud potential through AI. With a track record of hundreds of successful migrations and implementations across AWS and Salesforce, AllCloud has developed strategies and solutions that enable businesses of all sizes to remain at the forefront of innovation.
AllCloud is a leader in AI-led professional and managed services. As an AWS Premier and audited managed services Partner, and Salesforce Consulting partner, AllCloud provides comprehensive AI-led cloud journey support, from initial migration to ongoing management through our Engage Managed Services. Our expertise ensures that clients remain aligned with ecosystem best practices while focusing on their core business growth.
AllCloud serves clients across the globe with offices in EMEA and North America. www.allcloud.io
Job Summary
This is a customer-facing engineering role, and the customer-facing half is not optional or secondary. You will lead technical engagements directly: running recurring security reviews, presenting findings to both engineering teams and executive stakeholders, defending your recommendations, and driving remediation that the customer can realistically staff and fund.
You'll pair that with hands-on ownership of detective controls, guardrails, and incident response across the customer portfolio. You build the thing, and you explain the thing to the person paying for it.
You'll also be the technical authority behind our global SOC. They run the shifts; you make sure what they know is right.
Responsibilities
- Own client technical relationships, lead executive/developer security reviews, build prioritized remediation roadmaps, and communicate hard architectural risks directly.
- Deploy and tune AWS native tools (GuardDuty, Security Hub, Config, Inspector, CloudTrail) and Wiz; manage telemetry flowing into Datadog.
- Serve as the escalation authority for the SOC team, keeping playbooks updated and tuning detection logic to eliminate false positives.
- Lead investigations (timeline, root cause, executive reporting) and develop reusable Python/boto3 scripts for enrichment and containment.
- Architect security guardrails (SCPs, IAM, network policies) using Terraform or CDK; manage AWS LZA, Identity Center, and automated remediation pipelines.
What's genuinely different about this role.
We'd rather you hear this from us than discover it in a month or two.
- Context switching is the job. You'll move between customer environments with different architectures, different maturity, and different definitions of "urgent."
- You work through other people's accounts. Cross-account role design, delegated administration, and access boundaries are core skills here, not an afterthought. Getting access right for us is itself a security control we owe the customer.
- You don't get to know one estate deeply. The compensating skill is pattern recognition: spotting the same misconfiguration across ten different architectures.
- The customer is often the constraint. You'll regularly recommend something correct that the customer declines or defers. Learning to document that disagreement, and to keep advocating without becoming an obstacle, matters more here than in an in-house role.
Requirements
- 5+ years in cloud engineering, with at least 2+ years dedicated to AWS security.
- Proven track record leading technical reviews, delivering board/exec-ready reports, and advising external clients directly during high-pressure incidents.
- Deep expertise in IAM evaluation logic, SCPs, permission boundaries, cross-account federation, and KMS key architectures.
- Hands-on experience developing modular, scalable Terraform or CDK code.
- Practical administration of AWS Organizations, Control Tower, or Landing Zone Accelerator (LZA).
- Proficient in Python and boto3 for building production-grade, reusable security tooling and auto-remediations.
- Working knowledge of mapping PCI DSS or HIPAA controls directly to AWS infrastructure.
Nice to Have
- Hands-on experience with AWS LZA (customization repos/nested stacks), Wiz (or similar CNAPP/CSPM), and Datadog Cloud SIEM.
- Prior background in an MSSP, security consultancy, or presales/solutions architecture.
- Experience partnering with a 24/7 SOC to write actionable runbooks, escalation criteria, and tuning operational handoffs.
- Building EventBridge-driven auto-remediation, custom Config rules, and blocking CI/CD security gates (SAST/SCA/secrets).
- Hands-on network security architecture covering Transit Gateway segmentation, AWS Network Firewall, and VPC traffic inspection.
- Experience mapping infrastructure controls to SOC 2, ISO 27001, NIST 800-53, or FedRAMP.
- AWS Security Specialty or Solutions Architect Professional Certification
Why work for us?
Our team inspires progress in each other and in our customers through our relentless pursuit of excellence; you will work with leaders who promote learning and personal development. We offer competitive salaries, bonus incentives, benefits, flexible hours, and mentoring. Apply now to become part of the team.
AllCloud is an Equal Opportunity Employer and considers applicants for employment without regard to race, color, religion, sex, orientation, national origin, age, disability, genetics or any other basis forbidden under federal, provincial, or local law.
