Cloud and Platform Security Engineer

Cloud and Platform Security Engineer

Commitment:

6-months

Role Overview:

This role is responsible for hardening Greenstand’s cloud accounts, Kubernetes cluster, and delivery pipeline. The Cloud and Platform Security Engineer will work with the organization owners to reduce security risk across the platform, following a written, reversible plan for each production change.

Compensation:

Volunteer, until otherwise funded

Reports to:

Cloud Lead

Collaborates with:

Sr. Engineer, VP Engineering and Software Engineers

AREAS of RESPONSIBILITY

This role is responsible for ensuring the secure configuration, monitoring, and delivery of Greenstand’s cloud and infrastructure.

• Implement and maintain least-privilege access across AWS accounts and services
• Secure the CI/CD pipeline and production container delivery
• Identify and reduce network, storage and secrets exposure
• Establish logging and detection so security events are visible and actionable
• Support credential rotation and cleanup of exposed secrets
• Ensure every security change is documented in a repeatable runbook

REQUIRED TASKS

• Moving CI/CD deployments to short-lived credentials (GitHub Actions OIDC to AWS IAM roles)
• Scoping IAM users, groups and roles to least privilege, and requiring MFA for people
• Reviewing network and storage exposure: security groups, S3 bucket policies, CloudFront settings, and DNS records
• Turning on and tuning logging and detection: CloudTrail, AWS Config, Security HUb, GuardDuty, and alarms.
• Moving production container images to an organization-owned registry and pinning them by digest
• Improving secrets management and image hygiene in the Kubernetes cluster (DigitalOcean, Sealed Secrets)
• Helping the organization owners rotate credentials and remove old secrets from git history
• Writing a short runbook for each change so the next contributor can repeat it.

QUALIFICATIONS/EXPERIENCE/KNOWLEDGE:

• 3 or more years of hands-on work with AWS IAM, networking and S3 in production
• Ability to write and test least-privilege IAM policies
• Experience with GitHub Actions and OIDC federation to cloud provider
• A record of production changes with no outage, using staged rollout, testing and a rollback plan
• Discretion with sensitive information
• An AWS security certification, or equivalent experience, is a bonus but not required
• Familiarity with Terraform, Kubernetes and container registries (GHCR, Docker Hub) is a bonus but not required
• Earlier work with a non-profit organization or open-source project is a bonus but not required

Thank you for your interest in volunteering with Greenstand and for expressing your willingness to contribute as a product designer. We truly appreciate your enthusiasm for our cause and your desire to make a difference.As a volunteer, you'll have the opportunity to work closely with our team, gain valuable experience, and make a positive impact on the environment.

Next Steps...

Step 1: Complete Our Volunteer Registration Form: Tell us about your skills, goals, and volunteer expectations. - https://docs.google.com/forms/d/e/1FAIpQLSeEmwekGZ5tcc5sVhsgMDf-KEDBMtZYoCYAmxyxrOPv5w0WKA/viewform

Step 2: Join Greenstand Slack: Introduce yourself in the #community-intros channel and indicate the specific role you are interested in. We can’t wait to meet you! - https://join.slack.com/t/greenstand/shared_invite/zt-403l6k278-r_xHa8hfmgTtV1spTxWeNA