Senior Security Engineer At Credit Direct Limited
full-time
Job Summary
To design, implement and continuously improve the technical security controls that protect the organization's AWS cloud estate, Kubernetes (EKS) platform, software delivery pipelines and data stores; and to provide expert detection, response and assurance capability that keeps the organization's digital services resilient, auditable and compliant with CBN, PCI DSS, ISO 27001 and NDPR requirements.
RESPONSIBILITIES:
Cloud and Security Engineering:
Design, implement and maintain preventive and detective security controls across all AWS accounts, including AWS Organizations service control policies, AWS Config rules and conformance packs, AWS WAF and AWS Shield.
Enforce least privilege through IAM roles, permission boundaries, IAM Identity Center and IAM Access Analyzer; drive the elimination of long-lived access keys in favour of federated and role-based access.
Own AWS Secrets Manager end to end secret lifecycle, automatic rotation, resource and cross-account policies and lead the removal of hard-coded credentials from application code, manifests and pipelines.
Configure and maintain organization-wide AWS CloudTrail (including data and management events), CloudWatch log groups, metric filters, alarms and retention aligned to regulatory record-keeping requirements.
Implement AWS Config baselines with automated drift detection and remediation against CIS AWS Foundations and PCI DSS benchmarks.
Manage AWS WAF rule sets, rate limiting, bot control and geo restrictions for internet-facing applications behind CloudFront and ALB, and tune rules to minimise false positives without weakening protection.
Operate Amazon GuardDuty, AWS Security Hub, Amazon Inspector and Amazon Detective as a single triage workflow from finding, to enrichment and root-cause investigation, to verified closure.
Define and review secure landing zone and VPC network patterns (segmentation, private subnets, VPC endpoints, security groups, managed prefix lists) and assess new architectures against them.
Kubernetes & Container Security (Amazon EKS):
Harden EKS clusters: private API endpoints, control plane audit logging to CloudWatch, node group hardening, and timely patching of cluster versions and node AMIs.
Design, implement and periodically review Kubernetes RBAC, namespace isolation, service accounts and IAM Roles for Service Accounts (IRSA) / EKS Pod Identity.
Enforce Pod Security Standards, admission control policy (OPA Gatekeeper or Kyverno) and Kubernetes network policies to restrict east-west traffic.
Secure the container supply chain approved base images, ECR and Amazon Inspector image scanning, image signing and admission-time signature verification.
Deploy and tune runtime threat detection for containers (GuardDuty EKS Runtime Monitoring, Datadog Cloud Security Management) and investigate detections through to resolution.
Secure secret delivery into workloads using the External Secrets Operator or Secrets Store CSI driver backed by AWS Secrets Manager, removing plaintext secrets from manifests and Helm values.
Security Monitoring, Detection & Incident Response (Datadog):
Build and maintain detection coverage in Datadog Cloud SIEM log pipelines, detection rules, signal correlation, suppression tuning and security dashboards.
Operate Datadog Cloud Security Management (misconfiguration, identity and workload risk) and Application Security Management (runtime protection and vulnerability detection) alongside native AWS security services.
Configure Datadog Sensitive Data Scanner to detect and redact PII and cardholder data in logs and telemetry.
Ensure complete, tamper-evident log coverage across AWS, EKS, applications and databases, with defined retention, archiving and log integrity controls.
Lead technical security incident response triage, containment, eradication, recovery and post-incident review and maintain runbooks, escalation paths and tabletop exercises.
Define, track and report security metrics and posture trends to management and risk committees.
Data & Database Security:
Enforce encryption at rest and in transit across RDS, Aurora, DocumentDB, DynamoDB, S3, EBS and EFS using AWS KMS, with defined key policies, rotation and separation of duties.
Implement IAM database authentication and Secrets Manager-driven credential rotation; remove shared, static and over-privileged database accounts in favour of least-privilege roles.
Enable, centralise and monitor database audit logging (RDS and Aurora audit logs, DocumentDB auditing, SQL Server audit, CloudTrail data events) within the central log platform.
Apply data classification, masking or tokenisation and access controls for sensitive and regulated data, and support data loss prevention requirements.
Eliminate public database exposure private subnets, restrictive security groups, no public accessibility and validate backup and snapshot encryption, snapshot sharing controls and restore testing.
Review database migrations, schema changes and access grants for security impact before approval.
Governance, Risk & Compliance:
Translate CBN cybersecurity framework, PCI DSS, ISO 27001, NIST CSF and NDPR requirements into enforceable technical controls and repeatable evidence.
Maintain security standards, secure configuration baselines and control documentation, and support internal and external audits with automated evidence collection.
Conduct security assessments, vulnerability management cycles and configuration reviews; coordinate penetration testing and track remediation to closure.
Perform security reviews of third-party vendors, SaaS integrations and exposed APIs
Contribute to risk register maintenance, security exception management and management reporting.
Collaboration, Enablement & Technical Leadership:
Act as senior security advisor to infrastructure, platform, DevOps and application teams during architecture, design and change reviews.
Mentor junior security and platform engineers, and raise the standard of security code and configuration review across engineering.
Automate recurring security operations using Python, Bash, Terraform and AWS-native tooling to reduce manual effort and human error.
Deliver targeted, role-relevant security training for engineering teams covering secure coding, secrets handling and incident escalation.
COMPETENCIES REQUIREMENTS:
Technical:
Deep, hands-on AWS security expertise: IAM, KMS, Secrets Manager, CloudTrail, CloudWatch, AWS Config, WAF and Shield, GuardDuty, Security Hub, Inspector, Detective and VPC network security.
Strong Kubernetes and Amazon EKS security skills: RBAC, IRSA, Pod Security Standards, admission controllers (OPA Gatekeeper or Kyverno), network policies, image scanning, image signing and runtime security.
Practical experience implementing SCA, SAST, DAST, secret scanning and IaC scanning within GitHub Actions, and enforcing branch protection rules, rulesets and OIDC-based pipeline authentication.
Working knowledge of Datadog security capabilities: Cloud SIEM, Cloud Security Management, Application Security Management, Sensitive Data Scanner, log pipelines and dashboards.
Database security across RDS, Aurora, DocumentDB, SQL Server and NoSQL stores: encryption and key management, IAM authentication, audit logging, masking and least-privilege access.
Infrastructure as code and automation: Terraform, Helm and GitOps workflows, with proficient scripting in Python and Bash.
Solid grounding in security frameworks and regulation: CBN cybersecurity guidelines, PCI DSS, ISO 27001, NIST CSF, NDPR and GDPR; threat modelling (STRIDE) and MITRE ATT&CK.
Vulnerability management, incident response and digital forensics fundamentals.
Behavioural:
Strong analytical and problem-solving skills, with sound risk judgement and the ability to prioritise what matters most.
Excellent written and verbal communication; able to explain technical risk to non-technical stakeholders and influence engineering teams without direct authority.
Ownership mindset detail-oriented, proactive and persistent in identifying and closing control gaps.
Pragmatic and collaborative; balances security rigour against delivery velocity.
Calm, structured and decisive under incident pressure.
Coaching and knowledge-sharing orientation, with a commitment to raising security capability across the organization.
Requirements
Bachelor's degree in Computer Science, Information Security, Engineering or a related discipline.
Professional certification is strongly preferred, for example: AWS Certified Security - Specialty, Certified Kubernetes Security Specialist (CKS), CISSP, CISM, CCSP, OSCP, or GIAC certifications (GCSA, GCIH, GWAPT, GCLD).
Minimum of 6 - 8 years' experience in cybersecurity or security engineering, including at least 4 years securing production AWS workloads and at least 2 years securing Kubernetes (preferably Amazon EKS) and CI/CD pipelines.
Demonstrable, hands-on experience implementing cloud, container, pipeline and database security controls in a regulated environment; financial services experience is an advantage.
Proven track record of leading security incident investigations and remediation in production environments