Cloud Security Engineer

About the role

You will be the security guardian for Centience’s cloud environment, ensuring that every byte of data – at rest or in transit – is encrypted, monitored, and access‑controlled. Working closely with the Head of Data Science & Analytics, you will enable secure AI and machine‑learning pipelines while keeping compliance as a foundation, not a bottleneck.

Key responsibilities

• Design and enforce end‑to‑end encryption (AES‑256, TLS 1.2+) across AWS services such as S3, Redshift, RDS, Snowflake, and SageMaker.
• Manage cryptographic keys with AWS KMS, implement tokenisation, dynamic data masking, and column‑level encryption for PII.
• Define and maintain zero‑trust IAM policies, RBAC/ABAC, MFA, and federated SSO/SAML across all accounts and tooling.
• Operate continuous monitoring with GuardDuty, Security Hub, CloudTrail, and Config; create incident‑response playbooks for data exfiltration, model poisoning, and pipeline tampering.
• Own compliance for PDPA, GDPR and related regulations, maintaining audit‑ready logs and conducting security reviews for every major launch.
• Embed security scanning (SAST, DAST, SCA, container image scanning) into CI/CD pipelines and partner with DevOps on secrets management and signed model registries.

Required profile

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field.
• 5+ years of hands‑on experience securing cloud platforms, preferably AWS.
• Proven track record of implementing encryption, IAM, and zero‑trust architectures.
• Experience leading vulnerability management, penetration‑testing cadence, and SIEM integration.

Required skills

• AWS services (S3, Redshift, RDS, Snowflake, SageMaker, Databricks, Airflow)
• AWS KMS, GuardDuty, Security Hub, CloudTrail, Config
• Encryption standards (AES‑256, TLS 1.2+), tokenisation, data masking
• IAM design, RBAC, ABAC, MFA, SSO/SAML
• SIEM tools (AWS Security Lake, Splunk)
• CI/CD pipelines with security gates (SAST, DAST, SCA, container scanning)
• Vulnerability management, CVE scanning, penetration testing