Overview

CPI Card Group is seeking a Cloud Engineer with a DevSecOps focus and hands-on experience in Amazon Web Services (AWS), AWS Security Services, infrastructure automation, to join the Infrastructure Cloud Engineering team. This role implements, automates, and operates secure, resilient infrastructure capabilities across a hybrid environment that includes on-premises environments, AWS Infrastructure as a Service, and relevant SaaS integrations.

The position strengthens the Cloud Engineering organization with a focus on AWS Cloud Security, and associated security services, infrastructure delivery pipelines, threat-detection integration, vulnerability and configuration remediation, data-protection controls, incident response, and compliance-control implementation. The engineer contributes to reusable infrastructure patterns, standards, guardrails, and automated controls that integrate security throughout the platform engineering and CloudOps lifecycle.

Responsibilities

• AWS infrastructure security: Engineer and operate security capabilities supporting multi-account AWS environments, including logging, configuration compliance, threat detection, vulnerability visibility, network protection, encryption, and data protection. This work leverages AWS-native services such as AWS CloudTrail, AWS Config, Amazon GuardDuty, Amazon Inspector, AWS Security Hub, AWS Shield Advanced, and AWS KMS.
• Infrastructure as Code and automated controls: Develop and maintain Terraform, AWS CloudFormation, scripts, modules, policies, and automated workflows that provision secure infrastructures and platforms while continuously validating required security controls.
• Secure delivery pipelines: Implement and improve infrastructure delivery pipelines, including security testing, policy checks, approval controls, separation-of-duties requirements, artifact integrity, and controlled promotion across environments.
• Secure infrastructure patterns and standards: Implement and maintain secure, scalable, and resilient infrastructure patterns across AWS and hybrid integrations using approved architectures, standards, and guardrails.
• Threat, vulnerability, and risk reduction: Automate the identification, prioritization, tracking, and remediation of infrastructure vulnerabilities, insecure configurations, and control gaps. Provide technical evidence and remediation support for risk-management activities.
• Hybrid infrastructure protection: Integrate security controls across on-premises environments, AWS infrastructure, and relevant SaaS services. Support network segmentation, security groups, firewall integration, DDoS-resilient designs, secure connectivity, and infrastructure protection patterns.
• Security monitoring and response: Improve infrastructure telemetry, alerting, and operational response through AWS and enterprise monitoring platforms. Participate in security and infrastructure incidents, root-cause analysis, containment, recovery, and corrective-action automation.
• Compliance implementation and evidence: Partner with Cybersecurity to translate PCI DSS and other applicable control requirements into technical controls, validation methods, documentation, and repeatable audit evidence. CloudOps and platform operations: Monitor infrastructure health, security posture, reliability, and control effectiveness. Participate in lifecycle management, change management, problem management, operational readiness, and the team's 7x24 on-call rotation.
• Collaboration and documentation: Contribute to design reviews, technical documentation, and knowledge sharing. Communicate options, risks, tradeoffs, and recommendations to technical, non-technical, and leadership audiences.
• Continuous improvement: Evaluate relevant AWS services and industry practices, pilot improvements within approved guardrails, and reduce manual work through safe, measurable automation.

Qualifications

• Builds for operations: Designs infrastructure with day-two operations in mind. Monitoring, alerting, patching, backup, and recovery are part of "done," not added later.
• Builds security in: Treats security controls as engineering requirements that are coded, tested, and validated in the pipeline, not as reviews applied after deployment.
• Automates first: Prefers code over console changes. Spots repeated manual work and turns it into automation that is versioned, reviewed, and repeatable.
• Troubleshoots across layers: Diagnoses issues that span AWS, networking, identity, on-premises systems, and SaaS integrations. Uses logs, metrics, and security findings to find the root cause, not just the symptom.
• Works with operational discipline: Follows change management and approved standards. Leaves systems and runbooks in a state another engineer can support during an on-call event.
• Respects ownership boundaries: Understands what Cloud Engineering owns and what belongs to Cybersecurity and Technology Governance, Risk and Compliance, and knows how to engage those teams effectively.
• Exercises risk-aware judgment: Recognizes when a design, request, or shortcut creates unacceptable risk. Raises it with evidence and a recommended option, explained in plain terms for engineers, auditors, and leaders.
• Keeps learning: Keeps AWS, security, and automation skills current and applies what they learn to improve team patterns and practices.

Requirements:

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Engineering, Information Technology, or a related discipline, or comparable professional experience.
• Three or more years of experience in cloud engineering, infrastructure engineering, DevOps, DevSecOps, cloud security engineering, or comparable technical roles.
• Hands-on experience deploying, securing, and operating AWS infrastructure in production or regulated hybrid environments.
• Experience implementing or improving security controls within production cloud or hybrid infrastructure.
• Proficiency with Infrastructure as Code, preferably Terraform, with experience developing reusable modules, automated testing, policy validation, and controlled deployment practices.
• Hands-on experience with CI/CD platforms and source control, such as GitLab CI/CD, Jenkins, GitHub Actions, or AWS-native delivery services.
• Strong scripting or software automation skills using Python, Bash, PowerShell, or a comparable language.
• Experience with multi-account AWS environments, identity and access controls, logging and monitoring, configuration compliance, vulnerability management, encryption, data protection, and network security.
• Experience participating in infrastructure or security incident response, root-cause analysis, and corrective-action implementation.
• Working knowledge of regulated-industry security and compliance practices. Experience with PCI DSS is preferred.

Preferred Certification and Qualification Paths:

Candidates may demonstrate readiness through one or more of the following paths. AWS certifications are preferred; equivalent hands-on experience will be considered: Preferred path: An equivalent combination of AWS architecture, operations, security, automation, and production engineering experience aligned to the following certifications: AWS Certified Security – Specialty AWS Certified Solutions Architect – Associate or AWS Certified CloudOps Engineer – Associate

Additional desired qualifications: AWS certifications or equivalent experience aligned to: AWS Certified DevOps Engineer – Professional AWS Certified Solutions Architect – Professional AWS Certified AI Practitioner