DevSecOps Engineer – AWS & Azure

About the role

We are looking for a DevSecOps Engineer to own the security tooling we run for our managed services customers on AWS and Azure, and to own our company security and compliance program, including SOC 2. You will keep detection, vulnerability management and endpoint protection working across the customer fleet, turn findings into fixes through Terraform, and be the person auditors, customers and the team come to for security questions. This is a remote position based in Brazil.

Responsibilities

• Operate and improve our security stack across customer environments: AWS Security Hub, GuardDuty, Inspector, CloudTrail and AWS Config; Microsoft Defender for Cloud, Defender for Endpoint and Entra ID; CrowdStrike Falcon
• Run vulnerability and patch management: triage findings, prioritize by real exposure, drive remediation with the operations team and customers, and follow up on critical CVEs
• Tune alerting and automations so findings reach the right people with low noise, and handle security incidents end to end
• Build and change security controls with Terraform (SCPs, Azure Policy, IAM/RBAC, logging, guardrails), with code in GitHub and changes delivered through pull requests and CI/CD
• Run Well-Architected security reviews for customers and turn the results into remediation plans
• Own SOC 2 and other compliance programs: controls, evidence, policies, risk assessments, access reviews and the relationship with auditors
• Answer customer security questionnaires and support presales on security topics
• Write runbooks and standards, and raise the security bar of the engineering team

Requirements

• Fluent spoken and written English, used daily with customers and the team
• 5+ years in cloud security, DevSecOps or cloud operations with a security focus
• Hands-on experience with AWS security services (Security Hub, GuardDuty, Inspector, IAM, Organizations/SCPs) and with Microsoft Defender for Cloud and Entra ID
• Strong Terraform experience and daily use of Git and GitHub (pull requests, code review, GitHub Actions)
• Experience with an EDR platform, ideally CrowdStrike Falcon
• Practical experience running or supporting a SOC 2 or ISO 27001 program
• Scripting in Python or Bash

Nice to have

• AWS Certified Security – Specialty, Microsoft AZ-500 or SC-200, CCSP or CISSP
• Experience with a compliance automation platform such as Vanta or Drata
• Microsoft Sentinel or another SIEM
• Kubernetes security (EKS, AKS)
• Experience at an MSP, MSSP or consultancy, Spanish

Company Description skie.io helps organizations build and operate efficient, secure, and resilient AWS and Azure environments through a unified cloud operating model. The company focuses on improving architecture, security, governance, performance, reliability, and cloud economics, combining automation-first managed operations with intelligent automation. skie.io’s connected capabilities—Sage (IMPROVE), Guardian (OPERATE), and Muse (AUTOMATE)—work together to continuously optimize cloud environments and reduce operational burden. Their self-funding cloud flywheel enables verified savings that can be reinvested into modernization, AI, and further automation, making the cloud easier to operate and ready for future growth. skie.io is an AWS Advanced Tier Services Partner with AWS Cloud Operations and SAP Services Competencies, AWS Well-Architected expertise, and SOC 2 Type II compliance.