Lead Security Engineer

Lead Security Engineer

Location: Portland or Lewiston, Maine

Job Description

We are seeking an experienced Lead Security Engineer to design, build, and secure enterprise cloud infrastructure, with a strong focus on AWS security architecture, cloud governance, and infrastructure automation. This individual will lead the implementation of secure, scalable, and resilient cloud environments while establishing security standards, guardrails, and best practices across multi-account AWS environments.

The ideal candidate brings extensive hands-on AWS engineering experience, strong knowledge of enterprise infrastructure, and expertise in DevOps and Infrastructure as Code (IaC). This role requires the ability to build cloud foundations from the ground up, automate security controls, and integrate security throughout infrastructure provisioning and deployment processes.

Key Responsibilities

• Design, implement, and maintain secure AWS cloud architectures, including multi-account environments, landing zones, and centralized security services.
• Configure and manage AWS Organizations, Control Tower, IAM, IAM Identity Center, Service Control Policies (SCPs), and account governance.
• Implement cloud security controls across AWS services, including WAF, VPCs, EC2, S3, RDS, KMS, Secrets Manager, GuardDuty, Security Hub, CloudTrail, CloudWatch, AWS Config, Macie, and Inspector.
• Develop and automate security guardrails, compliance controls, encryption standards, network segmentation, privileged access management, and threat detection capabilities.
• Build and maintain Infrastructure as Code solutions using AWS CDK with Python, CloudFormation, or Terraform.
• Develop and maintain CI/CD pipelines and automated provisioning workflows to support repeatable, secure infrastructure deployments.
• Establish centralized logging, monitoring, alerting, and security event management across AWS accounts and workloads.
• Support enterprise infrastructure spanning Windows and Linux servers, virtualization, Active Directory, DNS, networking, storage, backup, monitoring, and disaster recovery.
• Design and implement cloud connectivity, shared services, network security, and standardized infrastructure configurations.
• Identify security vulnerabilities, assess risks, and implement remediation strategies aligned with enterprise security requirements and industry best practices.
• Collaborate with infrastructure, application development, DevOps, and security teams to integrate security into cloud engineering and operational processes.
• Provide technical leadership, establish engineering standards, and mentor team members on AWS security and infrastructure automation.

Required Qualifications

• Extensive hands-on experience in AWS cloud engineering, security architecture, and enterprise infrastructure.
• Strong knowledge of AWS Organizations, Control Tower, multi-account landing zones, IAM, IAM Identity Center, and Service Control Policies.
• Experience implementing AWS security services and controls, including GuardDuty, Security Hub, CloudTrail, CloudWatch, AWS Config, KMS, Secrets Manager, WAF, Macie, and Inspector.
• Strong Infrastructure as Code experience, preferably with AWS CDK and Python, as well as CloudFormation or Terraform.
• Experience developing automated infrastructure deployments using source control and CI/CD pipelines.
• Strong understanding of cloud networking, VPC architecture, network segmentation, access controls, encryption, and centralized logging.
• Experience building and securing cloud foundations from the ground up, including account structures, governance, connectivity, monitoring, and shared services.
• Broad enterprise infrastructure knowledge across Windows/Linux, virtualization, Active Directory, DNS, storage, backup, and disaster recovery.
• Ability to lead technical initiatives, troubleshoot complex infrastructure and security issues, and communicate effectively across technical teams.

Preferred Qualifications

• Experience implementing cloud security frameworks, governance standards, and compliance controls.
• Familiarity with security automation, continuous compliance, vulnerability management, and cloud threat detection.
• Experience integrating security requirements into DevOps and CI/CD workflows.
• AWS certifications in Security, Solutions Architecture, or DevOps are a plus.

Ideal Candidate

The successful candidate is a hands-on technical leader who combines deep AWS security expertise with broad infrastructure engineering knowledge. They can architect secure multi-account cloud environments, automate infrastructure and security controls using AWS CDK/Python, and establish scalable cloud governance and operational standards from the ground up.