layiq

/la·yiq/adjective

worthy; deserving; fitting; suitable.

A role, opportunity, or path that merits attention, time, and pursuit.

LAYIQ - Sr Platform Security Engineer at BusPatrol

Design, implement, and continuously improve security controls across BusPatrol’s AWS multi-account environments.
Establish least-privilege identity patterns using AWS IAM, IAM Identity Center, Entra ID, permission sets, groups, cross-account roles, service roles, and time-bound elevated access where appropriate.
Build and maintain secure, reusable Terraform modules and AWS CDK constructs for platform services, security controls, logging, encryption, networking, and account/environment guardrails.
Help evolve AWS Organizations, Control Tower, service control policies, account boundaries, and shared-services patterns to reduce blast radius and improve governance.
Secure cloud networking through practical controls for VPCs, routing, security groups, network ACLs, WAF, private connectivity, site-to-site VPNs, Direct Connect, and related network segmentation strategies.
Implement and operate secrets-management and encryption patterns using AWS KMS, Secrets Manager, Parameter Store, TLS, and automated credential rotation.
Integrate security checks into GitHub Actions and other delivery workflows, including infrastructure validation, dependency and vulnerability scanning, container/image security, SBOMs, signing, and policy enforcement.
Develop policy-as-code and preventive guardrails using appropriate tools such as AWS Config, SCPs, CloudFormation Guard, OPA, Conftest, Checkov, tfsec, or equivalent technologies.
Partner with engineering teams to define secure golden paths, platform templates, and documented patterns that make the safest implementation the easiest implementation.
Operate and improve cloud security telemetry and findings across services such as GuardDuty, Security Hub, CloudTrail, AWS Config, CloudWatch, and Datadog.
Triage, prioritize, and remediate platform security findings from CNAPP, CSPM, vulnerability-management, penetration-testing, and internal assessment tools, including Wiz or comparable platforms.
Support incident response, containment, root-cause analysis, and post-incident improvement for cloud, infrastructure, identity, and platform security events.
Produce concise architecture decisions, threat-informed control designs, runbooks, evidence, and operational documentation that engineering teams can use.
Collaborate with Cyber Security and GRC on SOC 2, ISO 27001, CIS, NIST, customer assurance, and audit-readiness activities without turning compliance into a manual exercise.
Mentor engineers through design reviews, infrastructure pull requests, office hours, and practical security enablement.
Contribute to secure AI-enabled engineering and platform workflows by protecting sensitive data, non-human identities, secrets, tool permissions, logging, and production change controls.

Sr Platform Security Engineer

Employer job description

Location:

Key Responsibilities

Qualifications

Preferred Qualifications

What We Offer

Compensation Note

Equal opportunity and accommodations

About this listing