Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 60 days ago

AWS Cloud Security Engineer

ON.energy42 open roles

Where
Argentina
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowAWS Cloud Security EngineerON.energy · Argentina

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on ON.energy's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. ON.energy postings stay open a median of 40 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 57.8%60 days
This job: posted 60 days ago

ON.energy median: 40 days open

The posting

ON.energy is setting the standard for large load interconnection. ON’s patented AI UPS™ is a medium-voltage UPS that serves as a firewall, protecting the data center from the grid, and the grid from the data center. With multiple gigawatts currently under construction, we are enabling grid-safe data centers.

Key Responsibilities

  • The multi-account security foundation. AWS Organizations structure, SCPs, guardrails, a security tooling account, centralized logging, and secure baselines — delivered as infrastructure as code, not console clicks.
  • Security standards and review gates. You can mandate controls and block deploys that introduce unacceptable risk, through review gates on identity and network changes, a documented exception path, and a defined escalation route.
  • AWS identity and access. IAM Identity Center as the single front door, federated with Entra ID in partnership with IT, who own Entra as the source of truth. Role and group model mapping job functions to permissions; joiner/mover/leaver; privileged and break-glass access; workload identity; recurring access reviews. Hands-on at first, progressively automated so it stops being manual work.
  • Cloud-to-site connectivity and segmentation — the defining part of this role. Every plant, BESS site, and remote asset that reaches our cloud does so over a path you design and defend: site-to-cloud VPN and private connectivity, hard segmentation between IT and OT zones, DMZ and broker patterns for site telemetry, certificate and device identity for field gateways, remote vendor access to sites, and strict control over what may initiate traffic in each direction. You own the cloud side of that boundary and share the path itself with the OT security owner.
  • Threat detection, monitoring, and mitigation. You are expected to know how attacks actually run — credential and token abuse, cross-account privilege escalation, exposed control and management interfaces, lateral movement from a compromised site network into cloud, supply-chain and dependency compromise, ransomware staging — and to build the monitoring that catches them. GuardDuty, Security Hub, Detective, Inspector, Config, and CloudTrail tuned for real signal-to-noise, detections mapped to MITRE ATT&CK and ATT&CK for ICS, runbooks the wider team can execute, and the mitigations driven to done.
  • Vulnerability management. Scanning coverage across workloads, images, and dependencies; risk-based triage and prioritization; remediation SLAs and exception handling; posture reporting. You identify and prioritize; the AWS engineers remediate in the workloads they own.

Key Requirements

  • 5+ years in cloud security, security-focused infrastructure, or cloud operations, with deep hands-on AWS.
  • Production experience in multi-account AWS environments.
  • Demonstrable command of attacker techniques and the detections and mitigations that counter them — you can walk an intrusion path end to end and explain how you would catch it, contain it, and close it.
  • Hybrid and site-to-cloud network security: segmentation, VPN, private connectivity, firewalls, routing, DNS, CIDR and subnetting — securing connections between cloud and physical facilities.
  • Strong AWS identity: roles, policies, permission sets, MFA, least privilege, access reviews; IAM Identity Center federated with an external IdP, ideally Microsoft Entra ID.
  • AWS-native security services: GuardDuty, Detective, Security Hub, Inspector, Config, CloudTrail, KMS, WAF.
  • Infrastructure as code — CDK, CloudFormation, or Terraform. You build controls, you don't click them.
  • Advanced English (B2–C1) for daily work with English-speaking teams and written security documentation.

Preferred Qualifications

  • Security experience in OT- or ICS-adjacent environments: IT/OT segmentation, Purdue-model zoning, secure remote access to field sites, and protocols such as Modbus, DNP3, OPC UA, or MQTT crossing into cloud.
  • Detection engineering and SIEM work; threat modelling; incident response you have personally run.
  • Regulated or compliance-driven environments where access control, monitoring, and audit evidence are held to an external standard.
  • Turning scanner output and audit findings into prioritized, actionable work for engineers who do not report to you.
  • Troubleshooting security, identity, networking, and infrastructure issues across cloud and hybrid environments.
  • Landing zones, Control Tower, and security account patterns.
  • IEC 62443 or NIST SP 800-82 familiarity.
  • Containers and serverless workloads.
  • Energy, utilities, or other mission-critical environments.
  • Wazuh, Datadog, Grafana, or similar.
  • Security documentation and ADRs.

Certifications

Valued as a signal, not a substitute for experience: AWS Certified Security – Specialty; AWS Certified Advanced Networking – Specialty; AWS Certified Solutions Architect; GICSP or GIAC GRID; CISSP; CCSP; Microsoft Certified: Identity and Access Administrator Associate.

#LI-AD1

For US-based roles - What you’ll get:

  • Competitive salary + annual performance-based bonus eligibility
  • Medical, dental, and vision insurance
  • 401(k) with company match
  • Paid time off and company holidays

For Mexico-based roles - What you’ll get:

  • Competitive salary + annual performance bonus eligibility
  • Christmas Bonus (Aguinaldo): 30 days
  • Major medical expenses and life insurance
  • Paid time off and holidays (per local policy)

For all roles:

  • Professional development and growth opportunities
  • Opportunity to grow with a mission-driven team shaping the future of clean energy
  • Equal Opportunity: ON.energy is committed to equal employment opportunity and to maintaining a work environment free of harassment, discrimination, or retaliation.
  • Benefits vary by role and location and are subject to change.

Agency Notice: ON.energy does not accept unsolicited resumes from staffing agencies, search firms, or third-party recruiters. Resumes submitted without a fully executed Master Services Agreement (MSA) and a written request from an authorized member of our Talent Acquisition team will be considered the property of ON.energy. No placement fees or compensation will be paid for unsolicited candidate submissions.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against ON.energy's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on ON.energy's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    ON.energy's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.