Cloud IAM Engineer

Position: Cloud IAM Engineer

Location: Alpharetta, Georgia, USA (Day-one onsite; hybrid with 3 days onsite per week.)

Type: Contract

Rate: Will discuss with your employer

Role overview

Hands-on AWS identity and access management engineer to remediate identity risks in the existing EquityZen environment and implement secure access in the target AWS environment. The engineer will work with cloud, application, security, and platform teams to deliver least-privilege access while supporting application migration and production continuity.

Key responsibilities

• Assess IAM users, roles, policies, trust relationships, service identities, and access keys; identify excessive permissions, unused access, and cross-account exposure.
• Remediate overly broad system-user permissions and replace long-lived credentials with IAM roles, temporary credentials, and approved workload identity patterns where appropriate.
• Design and implement least-privilege identity-based and resource-based policies for application access to S3, KMS, EKS, EC2, Lambda, and other services in scope.
• Configure and troubleshoot role assumption, cross-account access, federation, and permissions boundaries within enterprise guardrails.
• Implement approved EKS workload access patterns and coordinate Kubernetes RBAC with platform engineers.
• Support application teams adEligible to working enterprise OIDC/OAuth authentication and authorization, including the Zercon integration identified in the migration scope.
• Integrate approved secrets-management and credential-rotation patterns, coordinating with Vault and application owners.
• Automate IAM configuration through Infrastructure as Code and controlled deployment pipelines; validate changes in non-production before release.
• Use audit logs and policy-analysis tooling to verify intended access, investigate access failures, and demonstrate remediation effectiveness.
• Produce access matrices, implementation evidence, test results, rollback procedures, and operational runbooks for governance reviews, cutover, and handover.

Required skills and experience

• Proposed experience target: 7-10 years in infrastructure/security engineering, including 4+ years of hands-on AWS IAM or cloud security delivery; subject to client/SME validation.
• Strong practical knowledge of AWS policy evaluation, explicit denies, role trust policies, STS, cross-account access, resource policies, and least-privilege design.
• Hands-on experience with IAM roles, S3 access controls, KMS key policies, workload identities, and production access troubleshooting.
• Working knowledge of federation, SAML, OIDC, OAuth 2.0, secrets management, and Kubernetes access controls.
• Experience automating infrastructure or security controls using Terraform or CloudFormation, plus Python or shell scripting and Git-based change control.
• Ability to test permitted and denied access paths, assess application impact, and deliver changes through enterprise change-management processes.
• Clear communication and documentation skills; ability to coordinate directly with application owners, architects, and security reviewers.

Preferred qualifications

• Financial-services or other regulated-enterprise migration experience.
• Experience with AWS Organizations/SCPs, IAM Access Analyzer, CloudTrail, Vault, and enterprise identity providers.
• Relevant AWS security or architecture certification.

Expected deliverables

• Prioritized IAM findings and remediation evidence; target-state access and role matrix.
• Version-controlled policies and automation; access-validation results and migration readiness evidence.
• Operational runbooks and knowledge transfer for ongoing access administration.

Disclaimer: Diverse Lynx LLC is an Equal Opportunity Employer. All applicants and employees are evaluated without discrimination, based solely on their qualifications, ability, competence and performance. This email and its attachments may contain confidential or proprietary information and is intended only for the recipient(s). If you received this message in error, please disregard it and notify the sender. If you no longer wish to receive our communications, you may unsubscribe at any time.

Security Notice: Our official website is www.diverselynx.com We do not operate or authorize any other websites representing Diverse Lynx LLC.