Cloud security & devsecops engineer (aws) - 6 week contract

ABOUT THE ROLE

We are hiring a senior, hands-on engineer for a fixed 5 to 6 week, full-time, remote contract to deliver two pieces of infrastructure on AWS: a hardened security baseline across our account, and a sealed development environment where source code never leaves the cloud.

This is a delivery role, not an advisory one. A week-by-week plan already exists. You will personally build and configure everything below, deliver it in Terraform, document it, and hand it over.

WHAT YOU WILL BUILD

Workstream A: AWS security baseline

Enable and tune Cloud Trail, Guard Duty, AWS Config, Security Hub, Amazon Inspector and IAM Access Analyzer. Enforce MFA and an IAM password policy; review IAM users and roles for least privilege. Tighten security groups across the estate and move all administrative access to SSM Session Manager, so no SSH or RDP is reachable from the internet. Lock down S3 and database access; enable encryption at rest for EBS and RDS. Set up centralised patching with SSM Patch Manager and backups with AWS Backup. Configure security alerting with Cloud Watch alarms and SNS.

Workstream B: Sealed Development Environment

Build an isolated dev VPC with default-deny egress using AWS Network Firewall. Deploy Amazon Work Spaces virtual desktops with DLP controls: clipboard, local drive, USB and printing redirection disabled. Configure Git Hub so repository access (web, git, API) is only possible from inside the dev environment: SSO, IP allow list, hardened org policies. This part is well documented; prior Git Hub Enterprise admin experience is not required. Set up AWS Code Artifact as a package pull-through cache and self-hosted Git Hub Actions runners inside the enclave. Run a data-loss-prevention test matrix to prove code cannot leave; pilot with a small group, then roll out to all developers.

Cross-cutting

Everything as infrastructure as code in Terraform. Runbooks, an architecture diagram and admin documentation; a clean handover.

REQUIRED (all four)

AWS security services, hands-on. 5+ years in cloud infrastructure, Dev Ops or cloud security with deep AWS experience. You have personally enabled and tuned Cloud Trail, Guard Duty, Config, Security Hub, Inspector and IAM Access Analyzer, and worked with IAM, KMS and SSM in production. AWS networking. VPC design, security groups, NAT, VPC endpoints, and egress control with AWS Network Firewall or an equivalent. VDI or cloud development environments. You have built or administered Amazon Work Spaces, App Stream 2.0, Azure Virtual Desktop, Windows 365, Citrix, VMware Horizon or Omnissa, Coder, or equivalent, including the DLP side: clipboard, drive, USB and print redirection controls. This is the skill we most need to see evidence of. Terraform. You deliver infrastructure as code by default.

You can work independently against a fixed plan and deadline and communicate progress clearly.

NICE TO HAVE

Git Hub organisation administration: SSO/SAML, IP allow lists, org policy hardening. Experience in environments with SOC 2, ISO 27001 or HIPAA requirements. Identity provider integration: Google Workspace, Okta or Entra ID. Experience designing zero-egress or no-source-code-on-endpoint developer environments. Endpoint security or EDR deployment. AWS Security Specialty, Solutions Architect or Advanced Networking certifications.

ENGAGEMENT TERMS

Full-time for the engagement. This is not a part-time or evenings role. 5 to 6 weeks. The sixth week is a buffer for rollout and handover. Remote, with overlap with our core working hours. Fixed fee.

WHAT DONE LOOKS LIKE

The security services above are live and tuned, with Security Hub reporting at an agreed target score. The Sealed Development Environment is live for all developers and the DLP test matrix passes: code provably cannot leave the enclave. All work is in Terraform and documented, with a clean handover to our team.

HOW TO APPLY

Along with your profile, add two or three sentences describing a virtual desktop or sealed development environment you have built or administered, and which redirection or DLP controls you configured. Applications without this are unlikely to be shortlisted.