• Designs, implements, and continuously improves AWS security architecture. • Partners with cloud engineering, platform engineering, DevOps, Risk & Compliance, and product teams to build secure-by-default patterns, guardrails, and automation that enable delivery velocity without compromising security. • Influences cloud security strategy while providing hands-on architectural and engineering support. • Designs secure reference architectures and reusable security patterns for AWS workloads, including identity, networking, encryption, logging, monitoring, and secrets management. • Implements and operates enterprise AWS guardrails using Organizations, Control Tower, SCPs, AWS Config (managed and custom rules), Security Hub, GuardDuty, Detective, Macie, WAF/Shield, and AWS Network Firewall. • Applies least-privilege IAM using roles, permission boundaries, session policies, IAM Identity Center, SAML/OIDC federation, and ABAC/RBAC where appropriate. • Uses IAM Access Analyzer and automated validation to identify and reduce risk. • Designs secure VPC architectures, including subnet strategy, private endpoints, NAT and egress controls, Transit Gateway, Route 53, DNS Firewall, centralized ingress/egress, and service-to-service authentication. • Establishes detection-as-code and telemetry standards using CloudTrail, VPC Flow Logs, Route 53, RDS, ALB/NLB, and S3 access logs; integrates detections with SIEM/SOAR platforms. • Supports incident response through detections, playbooks, and tabletop exercises. • Embeds security into CI/CD pipelines using policy-as-code, Terraform checks, container and image scanning, SBOMs, and pre-commit hooks. • Automates remediation and drift detection using Lambda, Step Functions, and Terraform. • Maps technical controls to security frameworks including CIS AWS Foundations, NIST, ISO 27001, SOC 2, PCI DSS, and HIPAA (as applicable). • Conducts threat modeling (e.g., STRIDE) and risk assessments and drives remediation to closure. • Reviews designs, provides architectural guidance, and produces clear documentation and runbooks.

• Build and maintain services that interact with server BMCs over IPMI and Redfish across a heterogeneous hardware fleet (Dell, Supermicro, HPE, AMD, NVIDIA platforms) • Develop control-plane tooling for DPU provisioning and lifecycle management (NVIDIA BlueField, AMD Pensando) • Implement and harden serial-over-LAN, virtual media, and remote console workflows • Write Rust services (and Go/PHP where appropriate) that are observable, well-tested, and safe to run unattended at fleet scale • Contribute to internal SDKs and shared libraries used by other infrastructure teams • Partner with datacenter operations and hardware vendors to debug firmware, BMC, and DPU behavior in production • Participate in design reviews, code reviews, and on-call rotations for the OOB control plane • Improve test coverage, CI/CD pipelines, and tooling that lets us ship hardware automation safely • Document interfaces, runbooks, and failure modes so the system stays operable as it grows

• Monitor and analyze AWS usage and spend using AWS Cost Explorer, CloudHealth, CloudCheckr, or similar tools • Build and maintain dashboards to provide visibility into cloud financial metrics for stakeholders • Collaborate with engineering and product teams to identify cost-saving opportunities without compromising performance or reliability • Implement tagging strategies and enforce policies to ensure accurate cost allocation and reporting • Provide detailed forecasting, budgeting, and variance analysis for cloud expenditures • Contribute to cloud governance policies and educate teams on FinOps best practices • Recommend Reserved Instances, Savings Plans, and other AWS pricing strategies to optimize costs • Participate in cloud cost audits and help design cost-efficient architectures

• Design, implement, and manage advanced AWS networking architectures, including VPCs, Transit Gateways, Direct Connect, VPNs, PrivateLink, Route 53, Elastic Load Balancing, CloudFront, Global Accelerator, and related services. • Develop and maintain network architecture documentation, diagrams, technical standards, and configuration baselines to promote consistency, resilience, and compliance across cloud environments. • Collaborate with security teams to implement network-security controls, including security groups, network ACLs, AWS WAF, AWS Shield, AWS Network Firewall, segmentation, secure ingress and egress, and Zero Trust-aligned controls. • Design and support PKI-enabled application and network capabilities for digital signatures, encryption, identification, authentication, and secure communications. • Plan and document physical and network-access requirements for security testing; define internal and external test-environment connectivity, segmentation, access paths, and safeguards. • Evaluate existing network infrastructure and provide recommendations for optimization, modernization, risk reduction, and migration to AWS cloud environments. • Lead the design and implementation of hybrid cloud-networking solutions that securely connect on-premises data centers and other external environments to AWS. • Work closely with DevOps and engineering teams to integrate network solutions into CI/CD pipelines and IaC frameworks using Terraform, AWS CloudFormation, AWS CDK, or equivalent tools. • Implement and maintain advanced monitoring, detection, and analysis capabilities for cybersecurity threats using network telemetry, VPC Flow Logs, CloudWatch, and other approved tools. • Monitor network performance, troubleshoot complex connectivity and security issues, and implement corrective actions to maintain service availability and reliability. • Participate in Red Team/Blue Team exercises by designing test environments, validating network controls, analyzing results, and implementing approved remediation actions. • Support compliance efforts by ensuring network designs adhere to FedRAMP, NIST SP 800-53, FISMA, and other applicable federal security requirements. • Operate in an Agile delivery environment while satisfying government project requirements, stage gates, and documentation expectations. • Provide technical leadership, mentorship, and guidance to junior cloud and network engineers. • Remain current on emerging AWS networking technologies, services, and industry practices to continually improve cloud-networking capabilities.