Must‑Have Requirements

  Strong hands‑on experience as a Platform / Cloud Security Engineer securing AWS‑native data platforms.

  Deep understanding of AWS cloud security design, including:

    VPC architecture and network isolation

  Security Groups, Network ACLs (NACLs)

  Private access using VPC Endpoints / PrivateLink

  Hands‑on experience with AWS native security services, including:

  - AWS Security Hub

  - Amazon GuardDuty

  - Amazon Inspector

  - AWS CloudTrail

  - AWS Config

  - AWS KMS

  - AWS Secrets Manager

  Strong knowledge and practical application of AWS security best practices, including:

  - Least‑privilege IAM role and policy design

  - Encryption at rest and in transit

  - Secure secret and key management

  - Threat detection and continuous security monitoring

Nice‑to‑Have / Good‑to‑Have Requirements

  Experience securing real‑time or streaming data pipelines (e.g. CDC, event‑driven or near‑real‑time ingestion).

  Proven expertise securing AWS data pipelines, including ingestion, ETL/ELT processing, UPSERT patterns, and Change Data Capture (CDC) workloads.

  Exposure to Infrastructure as Code (IaC) using Terraform and/or AWS CloudFormation, with a security‑first approach.

  Familiarity with data‑level security controls such as data masking, tokenisation, or fine‑grained access controls.

  Experience supporting compliance, audit, or regulatory requirements (e.g. GDPR, SOC2, ISO‑27001) on AWS platforms.

  Exposure to extended AWS security services such as AWS WAF, Firewall Manager, OpenSearch/SIEM integrations, or centralised logging and monitoring.

  AWS certifications such as AWS Security – Specialty or AWS Solutions Architect (Associate/Professional).