InfoSec Governance Specialist

Conduct practical threat modeling across identities, APIs, workloads, networks, and data, identifying risks such as privilege escalation, credential theft, unauthorized access, and compromised workloads. Assess AWS cloud and network security, including PrivateLink, VPC endpoints, endpoint policies, security groups, segmentation, EKS posture, workload isolation, and container security.

Kforce has a client in NYC that is seeking an InfoSec Governance Specialist. Key Responsibilities:

• Design and govern AWS IAM controls across users, services, and workloads, including roles, trust policies, permission boundaries, SCPs, STS/AssumeRole, cross-account access, and least-privilege models
• Evaluate end-to-end identity and authentication flows using OAuth 2.0, OIDC, JWT, token exchange, delegation, and on-behalf-of patterns to ensure user identity and authorization are maintained across services and data
• Govern Amazon EKS workload identity, including IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, namespaces, and workload permissions
• Assess AWS cloud and network security, including PrivateLink, VPC endpoints, endpoint policies, security groups, segmentation, EKS posture, workload isolation, and container security
• Manage security standards around AWS KMS and Secrets Manager, including encryption, key policies, secrets access, key separation, and credential protection
• Establish data classification, entitlement, and authorization models that enforce least-privilege access to sensitive and regulated data
• Strengthen software supply chain security through SBOMs, image signing/verification, ECR scanning, vulnerability management, and controls preventing untrusted artifacts from deployment
• Use GuardDuty, Security Hub, and AWS Config to identify risks, configuration drift, and policy violations while helping automate security guardrails and remediation
• Conduct practical threat modeling across identities, APIs, workloads, networks, and data, identifying risks such as privilege escalation, credential theft, unauthorized access, and compromised workloads
• Partner closely with engineering and architecture teams to translate security and governance requirements into practical, scalable technical controls

Requirements:

• Experience securing Kubernetes environments, ideally Amazon EKS.
• Understanding of IRSA, EKS Pod Identity, Kubernetes RBAC, service accounts, and workload identity
• Experience with AWS KMS and Secrets Manager
• Knowledge of AWS networking and private access patterns, including VPCs, PrivateLink, VPC endpoints, endpoint policies, and security groups
• Experience with container security and software supply chain controls, including SBOMs, image signing, vulnerability scanning, and Amazon ECR
• Experience with GuardDuty, Security Hub, and AWS Config
• Strong understanding of data classification, authorization, entitlement design, and least-privilege principles
• Ability to conduct practical threat modeling and translate identified risks into implementable technical controls
• Experience operating in a financial services or similarly highly regulated environment

Strong hands-on knowledge of AWS security and IAM, including:

• IAM roles and policies
• Trust policies
• Permission boundaries
• Service Control Policies
• STS/AssumeRole
• Cross-account authorization

Strong understanding of modern authentication and authorization, including:

• OAuth 2.0
• OpenID Connect
• JWT
• Token exchange
• Delegated/on-behalf-of authentication

Preferred:

• Experience securing cloud-native data or AI platforms
• Familiarity with CI/CD security and automated security controls
• Understanding of infrastructure-as-code security and cloud configuration management
• Experience working with enterprise-scale AWS environments involving multiple accounts and centralized security governance
• Familiarity with financial-services security and regulatory expectations and frameworks such as NIST CSF, NIST 800-53, CIS Benchmarks, SOC 2, PCI DSS, or FFIEC guidance, where applicable
• Experience translating security policies into technical guardrails and automated controls