[Hiring] Lead Security Forward Deployed Engineer @EPAM Systems

Role Description

EPAM is hiring a Security Forward Deployed Engineer (FDE) to embed with our client and help joint clients turn security requirements into working, production-grade solutions on AWS. A Security FDE owns security outcomes end-to-end: from the first customer conversation to a deployed, handed-over solution.

• Embed with customer engineering and security teams, understand their threat landscape and constraints, and translate them into a delivery plan.
• Design and build secure AWS architectures: landing zones, identity and access (IAM, IAM Identity Center, SCPs), network segmentation, encryption and key management (KMS), secrets and data protection.
• Implement preventive and detective controls as code (Terraform, CloudFormation or CDK), including guardrails, policy-as-code and CI/CD security gates.
• Build detection and response capabilities using GuardDuty, Security Hub, Inspector, Detective, CloudTrail, Config and a customer SIEM; automate response with Lambda, EventBridge and Step Functions.
• Secure generative AI and agentic workloads, for example on Amazon Bedrock: threat modeling, prompt-injection and data-leakage defenses, guardrails, model and agent access control, and LLM supply-chain risk.
• Apply AI to security operations: triage and enrichment automation, alert summarization, and cloud posture analysis with measurable analyst time savings.
• Run threat modeling, architecture reviews, and compliance mapping (for example, NIST CSF, ISO 27001, SOC 2, PCI DSS, DORA, NIS2) to the customer's regulatory framework.
• Prototype quickly, then harden: move working solutions to production with tests, documentation, and runbooks.
• Transfer knowledge through pairing, workshops, and playbooks so customer teams can run what is built.
• Feed field learnings back to EPAM and AWS: reusable accelerators, reference architectures, and product feedback.
• Work with the AWS account team and partner stakeholders on scoping, delivery reviews, and customer success stories.

Qualifications

• Any active AWS Associate, Professional, or Specialty certification (e.g., AWS Certified Security – Specialty; AWS Solutions Architect – Associate/Professional or DevOps Engineer – Professional).
• 7+ years in security engineering, security architecture, or cloud security, with at least 4 years designing and building on AWS.
• Proven delivery in customer-facing or consulting roles: scoping, presenting to technical and executive audiences, and delivering under ambiguity.
• Deep working knowledge of AWS security services and patterns: IAM, Organizations and SCPs, KMS, VPC security, GuardDuty, Security Hub, CloudTrail, Config, WAF.
• Experience with Amazon Bedrock, SageMaker, or agent frameworks, including red-teaming or evaluating AI systems.
• Strong coding skills in Python (or Go/TypeScript) and infrastructure as code (Terraform, CloudFormation, or CDK).
• Experience with detection engineering and incident response in cloud environments.
• Working knowledge of container and Kubernetes security (EKS) and CI/CD pipeline security.
• Practical understanding of AI and LLM security risks (for example, the OWASP Top 10 for LLM Applications) and experience building with, or securing, GenAI services.
• Familiarity with security frameworks and regulations: NIST, ISO 27001, SOC 2, and one or more of PCI DSS, GDPR, DORA, NIS2.
• Excellent written and spoken English; comfortable running workshops and writing clear technical documentation.
• Willingness to travel and to work at customer sites as engagements require.

Requirements

• AWS Certified Generative AI Developer - Professional certification (nice to have).
• Security certifications such as CISSP, CISM, CCSP, or OSCP (nice to have).
• AI certifications such as Claude Certified Architect or OpenAI Technical Practitioner (nice to have).
• Experience with agentic vulnerability discovery, verification, and remediation tools, such as AWS Continuum and the open-source Visa Vulnerability Agentic Harness (VVAH), including running them safely on customer code and integrating them into CI/CD and developer workflows (nice to have).