Security & Governance Engineer

We are looking for a Security & Governance Engineer to establish and enforce security controls, governance standards, and compliance requirements across AI platforms, APIs, and cloud-native services. The role focuses on authentication, authorization, data protection, network isolation, and security validation of enterprise integrations. The ideal candidate has strong cloud security expertise, deep knowledge of identity management, and experience participating in enterprise security review processes.

Project overview:

• Our customer is a multinational corporation with more than a century of history and offices in over 180 countries. Their most ambitious goal at the time is to introduce a range of Reduced-Risk Products (RRPs). The target audience is more than 1 billion consumers around the globe. IT platform hosts 700+ applications.

Requirements:

• OAuth 2.0 / SigV4 / JWT security
• TLS 1.3 enforcement
• IT-STD-317 / enterprise security standards
• Data classification for tool payloads
• Security testing (OWASP, pen-test methodology)
• Network isolation (VPC, PrivateLink)

Experience:

• 4+ years application security or cloud security engineering
• Identity and access management (OAuth, JWT, OIDC)
• TLS/mTLS configuration in cloud environments
• Participation in InfoSec reviews for enterprise APIs

Will be a plus:

• MCP or tool-protocol security experience
• AWS WAF, Security Hub, Macie
• Prior work on enterprise AI platform governance

Responsibilities:

• Design and implement security controls for cloud-native applications, APIs, and AI platform integrations.
• Define and enforce OAuth 2.0, JWT, OIDC, and SigV4 authentication and authorization standards.
• Configure and maintain TLS 1.3 and secure communication channels across distributed systems.
• Establish governance requirements for tool integrations, API interactions, and AI platform workloads.
• Define and maintain data classification policies for tool payloads, metadata, and sensitive business information.
• Design and implement network isolation strategies using VPCs, PrivateLink, and cloud-native security controls.
• Perform security reviews, threat assessments, and architecture evaluations for enterprise services.
• Conduct security testing activities, including penetration testing, OWASP-based assessments, and vulnerability validation.
• Support InfoSec reviews, architecture review boards, and enterprise governance processes.
• Develop security standards, implementation guidance, and compliance documentation.
• Collaborate with engineering teams to embed security requirements into development and deployment workflows.
• Monitor security posture and recommend improvements across cloud and AI platform environments.
• Partner with stakeholders to ensure compliance with enterprise security policies and standards.