InfoSec Governance Specialist

Requirements:

• Experience securing Kubernetes environments, preferably Amazon EKS, including IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, and workload identity.
• Hands-on expertise with AWS security and IAM, including IAM roles and policies, trust policies, permission boundaries, Service Control Policies, STS/AssumeRole, and cross-account authorization.
• Strong understanding of modern authentication and authorization, including OAuth 2.0, OpenID Connect, JWT, token exchange, and delegated or on-behalf-of authentication.
• Experience with AWS KMS and Secrets Manager, plus AWS networking and private access patterns such as VPCs, PrivateLink, VPC endpoints, endpoint policies, and security groups.
• Experience with container security and software supply chain controls, including SBOMs, image signing, vulnerability scanning, and Amazon ECR.
• Experience with GuardDuty, Security Hub, and AWS Config.
• Strong understanding of data classification, authorization, entitlement design, and least-privilege principles.
• Ability to conduct practical threat modeling and translate identified risks into implementable technical controls.
• Experience in financial services or a similarly regulated environment.
• Preferred: Experience securing cloud-native data or AI platforms, CI/CD security, automated security controls, infrastructure-as-code security, cloud configuration management, and enterprise-scale AWS environments with multiple accounts and centralized governance.
• Preferred: Familiarity with financial-services security and regulatory frameworks or guidance such as NIST CSF, NIST 800-53, CIS Benchmarks, SOC 2, PCI DSS, or FFIEC.
• Preferred: Experience translating security policies into technical guardrails and automated controls.

Responsibilities:

• Design and govern AWS IAM controls for users, services, and workloads, including roles, trust policies, permission boundaries, SCPs, STS/AssumeRole, cross-account access, and least-privilege models.
• Evaluate identity and authentication flows using OAuth 2.0, OIDC, JWT, token exchange, delegation, and on-behalf-of patterns to preserve identity and authorization across services and data.
• Govern Amazon EKS workload identity, including IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, namespaces, and workload permissions.
• Assess AWS cloud and network security, including PrivateLink, VPC endpoints, endpoint policies, security groups, segmentation, EKS posture, workload isolation, and container security.
• Manage security standards for AWS KMS and Secrets Manager, including encryption, key policies, secrets access, key separation, and credential protection.
• Establish data classification, entitlement, and authorization models that enforce least-privilege access to sensitive and regulated data.
• Strengthen software supply chain security through SBOMs, image signing and verification, ECR scanning, vulnerability management, and controls that prevent untrusted artifacts from being deployed.
• Use GuardDuty, Security Hub, and AWS Config to identify risks, configuration drift, and policy violations, and help automate security guardrails and remediation.
• Conduct practical threat modeling across identities, APIs, workloads, networks, and data, identifying risks such as privilege escalation, credential theft, unauthorized access, and compromised workloads.
• Partner with engineering and architecture teams to turn security and governance requirements into practical, scalable technical controls.

Technologies:

• AI
• AWS
• CI/CD
• Cloud
• IAM
• JWT
• Kubernetes
• Network
• OAuth
• OpenID
• RBAC
• Security
• DevOps
• LESS

More

We are recruiting for our client in New York City, which is seeking an InfoSec Governance Specialist. Compensation is determined by factors including relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract, and business needs; the posted range may be changed, and this role is not eligible for bonuses, incentives, or commissions. Eligible employees may receive medical, dental, and vision insurance, HSA and FSA options, a 401(k), and life, disability, and accidental death and dismemberment insurance. Salaried employees receive paid time off; hourly employees generally do not, except where required by law, and hourly employees on Service Contract Act projects receive paid sick leave. We are an equal opportunity employer.

last updated 43 week of 2026