Ensure seamless log ingestion from AWS cloud infrastructure (CloudTrail, VPC Flow Logs, Amazon GuardDuty) to the Hybrid SIEM platform (Splunk) in near real-time via Splunk Forwarder configuration.
Perform automated checks and mitigation of control drift between security policies/configurations in AWS and on-premises environments to ensure no security gaps arise due to duplicate environments.
Be responsible for the availability, performance, and technical architecture of cloud security components, and ensure that automated alerts are triggered in the event of performance degradation in the security stack.
Verify asset readiness, IAM account mapping, and distributed telemetry management to ensure they are optimally monitored by the 24x7 SOC operations team.
Collaborate with the AWS Migration Team, Infrastructure Team, and SOAR Engineers to design an environment-aware automated response architecture (such as EC2 isolation automation, Security Group modifications, and global block synchronization on AWS WAF)
Certifications
AWS Certified Security – Specialty
AWS Certified Solutions Architect – Professional / Associate
Certified Information Systems Security Professional (CISSP)
At least 5–6 years of experience in cybersecurity engineering, with at least 3 years specializing as a Security Engineer or Cloud Security Engineer working with enterprise-scale Amazon Web Services (AWS) architectures
Practical experience with large-scale log forwarding/ingestion architectures from AWS to SIEM infrastructure (preferably Splunk)
Familiarity with managing or integrating multi-vendor security controls such as Palo Alto Firewall, CrowdStrike EDR, Imperva WAF/DAM, Sangfor NDR, or Arbor DDoS.
Proficiency in scripting (Python/Bash) or Infrastructure as Code (IaC) tools like Terraform to automate configuration compliance audits on AWS.
