Cloud IAM Engineer

Position: Cloud IAM Engineer

Location: Alpharetta Georgia USA (Day-one onsite; hybrid with 3 days onsite per week.)

Type: Contract

Rate: Will discuss with your employer

Role overview

Hands-on AWS identity and access management engineer to remediate identity risks in the existing EquityZen environment and implement secure access in the target AWS environment. The engineer will work with cloud application security and platform teams to deliver least-privilege access while supporting application migration and production continuity.

Key responsibilities

• Assess IAM users roles policies trust relationships service identities and access keys; identify excessive permissions unused access and cross-account exposure.
• Remediate overly broad system-user permissions and replace long-lived credentials with IAM roles temporary credentials and approved workload identity patterns where appropriate.
• Design and implement least-privilege identity-based and resource-based policies for application access to S3 KMS EKS EC2 Lambda and other services in scope.
• Configure and troubleshoot role assumption cross-account access federation and permissions boundaries within enterprise guardrails.
• Implement approved EKS workload access patterns and coordinate Kubernetes RBAC with platform engineers.
• Support application teams adEligible to working enterprise OIDC/OAuth authentication and authorization including the Zercon integration identified in the migration scope.
• Integrate approved secrets-management and credential-rotation patterns coordinating with Vault and application owners.
• Automate IAM configuration through Infrastructure as Code and controlled deployment pipelines; validate changes in non-production before release.
• Use audit logs and policy-analysis tooling to verify intended access investigate access failures and demonstrate remediation effectiveness.
• Produce access matrices implementation evidence test results rollback procedures and operational runbooks for governance reviews cutover and handover.

Required skills and experience

• Proposed experience target: 710 years in infrastructure/security engineering including 4 years of hands-on AWS IAM or cloud security delivery; subject to client/SME validation.
• Strong practical knowledge of AWS policy evaluation explicit denies role trust policies STS cross-account access resource policies and least-privilege design.
• Hands-on experience with IAM roles S3 access controls KMS key policies workload identities and production access troubleshooting.
• Working knowledge of federation SAML OIDC OAuth 2.0 secrets management and Kubernetes access controls.
• Experience automating infrastructure or security controls using Terraform or CloudFormation plus Python or shell scripting and Git-based change control.
• Ability to test permitted and denied access paths assess application impact and deliver changes through enterprise change-management processes.
• Clear communication and documentation skills; ability to coordinate directly with application owners architects and security reviewers.

Preferred qualifications

• Financial-services or other regulated-enterprise migration experience.
• Experience with AWS Organizations/SCPs IAM Access Analyzer CloudTrail Vault and enterprise identity providers.
• Relevant AWS security or architecture certification.

Expected deliverables

• Prioritized IAM findings and remediation evidence; target-state access and role matrix.
• Version-controlled policies and automation; access-validation results and migration readiness evidence.
• Operational runbooks and knowledge transfer for ongoing access administration.