Senior AWS Cloud Security Engineer; Part-Time , Fintech

Position: Senior AWS Cloud Security Engineer (Part-Time Contract, Fintech)

Scalable Path is looking for a part-time,
AI-first Security Engineer with an AWS CDK Focus to join the team. This is a remote, full-time (40 hours/week) position.

Client company description

The client is a well-backed New York startup in building a generic loan origination and automated underwriting platform from scratch.

Overview

The client is building a loan origination and automated underwriting platform. The build is AI-primary: most of the code and infrastructure is generated by AI against a documented architecture, with two senior engineers reviewing what ships. You are the standing independent security eye on all of it — part-time, roughly half-time for the first three months while accounts, identity, keys, and CI gates are being built, then lighter and steady.

Your lane is the control surface: the AWS organization and account structure (dev, staging, prod-shaped), IAM and per-seat least-privilege access, SSO and identity, tenancy boundaries with per-tenant KMS keys, secrets handling with short-lived credentials, the audit spine, and the security gates in CI. Much of that will be authored by AI in CDK. Your job is to own it — design the boundaries, review every change to them, and be the person who says no.

The platform is built to SOC 2-shaped controls by construction, without a formal program in this window, and never touches real borrower data outside production. You keep both of those true.

This suits someone who thinks in blast radius and trust boundaries, who can read a CDK stack or an IAM policy generated by someone — or something — else and see what it actually grants, and who is comfortable being the independent reviewer rather than the builder.

Responsibilities

• Own the AWS organization design: account structure, guardrails, SSO and identity, and the pipeline-only path to production — no human writes to prod.
• Own IAM and access for an offshore contractor team: per-seat least privilege, short-lived credentials, secrets that never leave vaults, 2FA everywhere, no shared accounts.
• Own tenancy and key management: per-tenant KMS boundaries, encryption posture, and the audit spine that records who did what.
• Own the security gates in CI: policy checks on CDK changes, dependency and secret scanning, and the rule that infrastructure changes need your sign-off.
• Review AI-generated infrastructure and security-relevant application code — CDK in Type Script, auth, tenancy, data access — as the standing independent reviewer.
• Shape the security posture of the AI gateway: prompt-injection surface, kill switches, provenance logging, per-tenant metering.
• Keep controls evidence as you go, so a SOC 2 program or an external audit can start from a running system rather than a blank page.

Qualifications

• Senior security or platform-security engineer with deep AWS:
  Organizations, IAM, KMS, SSO/identity, VPC boundaries, Cloud Trail. You have designed multi-account setups, not just operated inside one.
• Fluent with infrastructure as code, ideally CDK in Type Script. You can read a synthesized stack and tell what it grants.
• You know what SOC 2-shaped controls look like in practice — change management through reviewed pipelines, access reviews, audit logging — and can build them by construction without a compliance program to lean on.
• Comfortable reviewing AI-generated code and infrastructure. You direct AI tooling yourself and know its failure modes on security-sensitive work.
• Comfortable being the reviewer of record for the control surface. You would rather own that judgment than the keystrokes.
• Strongly preferred: fintech or regulated-data experience; multi-tenant SaaS security; securing LLM-backed features.
• Nice to have:
  Git Hub Actions hardening; security configuration of managed services such as Temporal Cloud.
• A…