Cloud Engineer

CPI Card Group is seeking a Cloud Engineer with a DevSecOps focus and hands-on experience in Amazon Web Services (AWS), AWS Security Services, infrastructure automation, to join the Infrastructure Cloud Engineering team. This role implements, automates, and operates secure, resilient infrastructure capabilities across a hybrid environment that includes on-premises environments, AWS Infrastructure as a Service, and relevant SaaS integrations.

The position strengthens the Cloud Engineering organization with a focus on AWS Cloud Security, and associated security services, infrastructure delivery pipelines, threat-detection integration, vulnerability and configuration remediation, data-protection controls, incident response, and compliance-control implementation. The engineer contributes to reusable infrastructure patterns, standards, guardrails, and automated controls that integrate security throughout the platform
engineering and CloudOps lifecycle.

Working closely with Cybersecurity, Software Engineering, and other technology teams, this role translates security and compliance requirements into implementable infrastructure capabilities. This role is accountable for incorporating AWS Cloud Security controls within the scope of Infrastructure Cloud Engineering and associated infrastructure cloud platforms. Enterprise cybersecurity architecture, security policy, and cyber-risk governance remain with Cybersecurity.

• AWS infrastructure security: Engineer and operate security capabilities supporting multi-account AWS environments, including logging, configuration compliance, threat detection, vulnerability visibility, network protection, encryption, and data protection. This work leverages AWS-native services such as AWS CloudTrail, AWS Config, Amazon GuardDuty, Amazon Inspector, AWS Security Hub, AWS Shield Advanced, and AWS KMS.
• Infrastructure as Code and automated controls: Develop and maintain Terraform, AWS CloudFormation, scripts, modules, policies, and automated workflows that provision secure infrastructures and platforms while continuously validating required security controls.
• Secure delivery pipelines: Implement and improve infrastructure delivery pipelines, including security testing, policy checks, approval controls, separation-of-duties requirements, artifact integrity, and controlled promotion across environments.
• Secure infrastructure patterns and standards: Implement and maintain secure, scalable, and resilient infrastructure patterns across AWS and hybrid integrations using approved architectures, standards, and guardrails.
• Threat, vulnerability, and risk reduction: Automate the identification, prioritization, tracking, and remediation of infrastructure vulnerabilities, insecure configurations, and control gaps. Provide technical evidence and remediation support for risk-management
  activities.
• Hybrid infrastructure protection: Integrate security controls across on-premises environments, AWS infrastructure, and relevant SaaS services. Support network
  segmentation, security groups, firewall integration, DDoS-resilient designs, secure connectivity, and infrastructure protection patterns.
• Security monitoring and response: Improve infrastructure telemetry, alerting, and operational response through AWS and enterprise monitoring platforms. Participate in security and infrastructure incidents, root-cause analysis, containment, recovery, and
  corrective-action automation.
• Compliance implementation and evidence: Partner with Cybersecurity to translate PCI DSS and other applicable control requirements into technical controls, validation methods, documentation, and repeatable audit evidence. CloudOps and platform operations: Monitor infrastructure health, security posture, reliability, and control effectiveness. Participate in lifecycle management, change management, problem management, operational readiness, and the team's 7x24 on-call
  rotation.
• Collaboration and documentation: Contribute to design reviews, technical documentation, and knowledge sharing. Communicate options, risks, tradeoffs, and
  recommendations to technical, non-technical, and leadership audiences.
• Continuous improvement: Evaluate relevant AWS services and industry practices, pilot improvements within approved guardrails, and reduce manual work through safe, measurable automation.

• Builds for operations: Designs infrastructure with day-two operations in mind. Monitoring, alerting, patching, backup, and recovery are part of "done," not added later.
• Builds security in: Treats security controls as engineering requirements that are coded, tested, and validated in the pipeline, not as reviews applied after deployment.
• Automates first: Prefers code over console changes. Spots repeated manual work and turns it into automation that is versioned, reviewed, and repeatable.
• Troubleshoots across layers: Diagnoses issues that span AWS, networking, identity, on-premises systems, and SaaS integrations. Uses logs, metrics, and security findings to find the root cause, not just the symptom.
• Works with operational discipline: Follows change management and approved standards. Leaves systems and runbooks in a state another engineer can support during an on-call event.
• Respects ownership boundaries: Understands what Cloud Engineering owns and what belongs to Cybersecurity and Technology Governance, Risk and Compliance, and knows how to engage those teams effectively.
• Exercises risk-aware judgment: Recognizes when a design, request, or shortcut creates unacceptable risk. Raises it with evidence and a recommended option, explained in plain terms for engineers, auditors, and leaders.
• Keeps learning: Keeps AWS, security, and automation skills current and applies what they learn to improve team patterns and practices.

Requirements:

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Engineering, Information Technology, or a related discipline, or comparable professional experience.
• Three or more years of experience in cloud engineering, infrastructure engineering, DevOps, DevSecOps, cloud security engineering, or comparable technical roles.
• Hands-on experience deploying, securing, and operating AWS infrastructure in production or regulated hybrid environments.
• Experience implementing or improving security controls within production cloud or hybrid infrastructure.
• Proficiency with Infrastructure as Code, preferably Terraform, with experience developing reusable modules, automated testing, policy validation, and controlled deployment practices.
• Hands-on experience with CI/CD platforms and source control, such as GitLab CI/CD, Jenkins, GitHub Actions, or AWS-native delivery services.
• Strong scripting or software automation skills using Python, Bash, PowerShell, or a comparable language.
• Experience with multi-account AWS environments, identity and access controls, logging and monitoring, configuration compliance, vulnerability management, encryption, data protection, and network security.
• Experience participating in infrastructure or security incident response, root-cause analysis, and corrective-action implementation.
• Working knowledge of regulated-industry security and compliance practices. Experience with PCI DSS is preferred.

Preferred Certification and Qualification Paths:

Candidates may demonstrate readiness through one or more of the following paths. AWS certifications are preferred; equivalent hands-on experience will be considered:
Preferred path: An equivalent combination of AWS architecture, operations, security, automation, and production engineering experience aligned to the following certifications:
AWS Certified Security – Specialty
AWS Certified Solutions Architect – Associate or AWS Certified CloudOps Engineer – Associate

Additional desired qualifications: AWS certifications or equivalent experience aligned to:
AWS Certified DevOps Engineer – Professional
AWS Certified Solutions Architect – Professional
AWS Certified AI Practitioner