We are seeking a hands-on Senior AWS DevOps & Cloud Security Engineer to secure, stabilize and maintain legacy applications hosted on AWS. This role focuses on resolving identified vulnerabilities and their root causes across production, test and development environments through technical remediation, not documentation or risk exceptions.

The successful candidate will own the complete remediation lifecycle from investigation through code and configuration changes, testing, deployment, validation and closure, while collaborating with application owners and General Cybersecurity teams.

About the Role

This is a hands-on engineering position requiring deep technical expertise in AWS security remediation. You will investigate unfamiliar legacy systems, interpret security findings, prioritize exploitability and data exposure risks, and implement fixes with technical evidence for closure. The role emphasizes practical problem-solving and reducing repeat findings through automation and hardened configurations.

Key Responsibilities

- Own an inventory and remediation backlog covering all AWS accounts and environments, deduplicating findings and documenting owners, severity, dependencies, fixes, validation and status
- Remediate exposed and over-privileged ECS workloads by patching vulnerable base images and packages, restricting ingress, minimizing task permissions and protecting sensitive data access
- Investigate and fix Cognito identity-pool misconfigurations, insecure IAM trust relationships and unintended unauthenticated access
- Implement AWS data-protection controls including DynamoDB deletion protection, access restrictions, encryption and recovery safeguards




- Address EC2, Windows and operating-system vulnerabilities through patching or approved mitigations
- Build and deploy tested changes safely across development, test and production with rollback plans, monitoring and operational documentation
- Coordinate with Cloud Security teams to rescan and verify remediation; escalate blockers and residual risks promptly
- Reduce repeat findings through automation, dependency update processes, hardened images, CI/CD security checks and configuration standards
- Leverage AWS CloudWatch, CloudTrail, Systems Manager, AWS Config, Security Hub, GuardDuty and container registries such as ECR
- Work with legacy MQTT/IoT integrations and bridge services; coordinate Windows Server patching and DynamoDB work
- Identify, remediate and validate cloud and application security vulnerabilities using Wiz and Veracode, including coordinating rescans and closing findings
- Implement code scanning with SonarQube, resolve security and quality issues, and establish realistic code coverage targets for legacy applications

Required Skills & Experience

- 5–8+ years of hands-on AWS and cloud security experience
- Expert-level knowledge of AWS ECS and Docker: services, task definitions, container images, build/rebuild, image scanning,



deployment and rollback; understanding of task roles versus task execution roles
- Advanced AWS IAM and identity expertise: least-privilege policy design, role and trust-policy remediation, permission analysis, workload credentials and AWS Cognito Identity Pools including unauthenticated identities
- Strong AWS networking skills: VPC, subnets, security groups, load balancers, HTTPS ingress, public/private exposure and attack-surface reduction
- DevOps and delivery proficiency: Git, CI/CD, infrastructure as code (Terraform or CloudFormation), release automation, logging, troubleshooting and production change controls
- Application dependency remediation: Node.js/npm and TypeScript fundamentals; ability to upgrade vulnerable libraries, resolve breaking changes, rebuild containers and run regression tests
- Cloud security execution: ability to interpret Wiz findings and CVEs, prioritize exploitability and data exposure, implement fixes and provide technical evidence
- Operational scripting: Python, Bash or PowerShell; comfortable investigating unfamiliar legacy systems with incomplete documentation
- Experience with AWS CloudWatch, CloudTrail, Systems Manager, AWS Config, Security Hub, GuardDuty and container registries
- Familiarity with security benchmarks (CIS/NIST) and AWS certification

Nice to Have

- Experience with legacy MQTT/IoT integrations and bridge services
- Working knowledge of Windows Server patching
- Kubernetes/EKS experience
- Infrastructure incident response expertise
- Data-protection controls implementation experience

📌 AWS DevOps & Cloud Security Engineer (México)
🏢 Aptonet
📍 México