Principal Cloud Engineer

The Space Telescope Science Institute (STScI) is a multi-mission science and operations center for NASA’s flagship observatories. The Principal Cloud Engineer will lead AWS cloud security automation initiatives, design and operate security controls across mission environments, and build secure platform engineering capabilities using Kubernetes and infrastructure as code.

Responsibilities:

• Serve as the technical lead for cloud security automation, partnering with software engineers, Institute security engineers, and DevOps engineers to design and deliver secure cloud capabilities
• Take solutions from idea to production independently: identify the gaps, propose an approach, socialize it with stakeholders, and own delivery through implementation
• Design, deploy, and secure workloads on Amazon EKS, including cluster hardening, workload identity, admission control, and runtime protection
• Drive platform engineering implementation by building paved road tooling, reusable modules, and self-service capabilities so product teams can ship securely by default
• Build and maintain infrastructure as code using CloudFormation, Terraform, or CDK, with security controls and guardrails expressed as code
• Embed automated security testing and policy enforcement into CI/CD pipelines
• Build and operate automated incident response workflows spanning detection, triage, containment, and remediation
• Evaluate and implement agentic AI capabilities to automate security engineering and operational tasks, with appropriate guardrails and human review
• Collaborate across engineering, IT, and other security teams, and build relationships with internal customers to identify needs and increase the impact of the team's work

Requirements:

• U.S. Citizenship or Permanent Residency required
• ITAR clearance required
• Minimum of 10 years of experience in one or more of the following roles: Software Developer, System Development Engineer, Site Reliability Engineer, or DevOps Engineer
• Minimum of 7 years of experience as a Cloud Security Automation Engineer or Cloud DevSecOps Engineer
• Hands-on experience deploying and operating Amazon EKS in production
• Demonstrated experience implementing platform engineering practices, including internal developer platforms or self-service tooling
• Deep expertise in AWS cloud security and automation
• Expertise with infrastructure as code using CloudFormation, Terraform, or CDK
• Experience designing and operating automated incident response
• Strong grounding in DevOps principles and automated security testing within CI/CD
• Applied knowledge of cloud security best practices and control frameworks
• Proven ability to work independently and drive solutions to completion through active stakeholder engagement
• Experience with single sign-on platforms such as Okta, Auth0, or similar
• Experience with log management and dashboarding using Datadog, ELK, or similar platforms
• Experience implementing agentic AI or LLM-based automation in an engineering or security context
• Professional-level certifications such as AWS Certified DevOps Engineer – Professional, AWS Certified Solutions Architect – Professional, and a Kubernetes certification such as Certified Kubernetes Administrator (CKA) or Certified Kubernetes Security Specialist (CKS)