Cloud Operations Engineer (AWS)

Role summary

The Cloud Operations Engineer owns the security of the full Ancileo tech stack, LEA and Distribution: every application protected against attack, recovery plans proven to work, and the lead on the technical response if we are attacked. The role also backs up the Architecture and CloudOps team on incidents and releases, and keeps our Drata compliance score healthy by fixing findings at the source.

This is a hands-on engineering role. You will spend most of your time in AWS, not in spreadsheets.

Key responsibilities

1. Cloud security and monitoring across LEA and Distribution (40%)

Cloud security baseline

• Run and tune the AWS security stack: GuardDuty, Security Hub, Inspector, Config, CloudTrail and IAM Access Analyzer.

• Own monitoring and alerting: CloudWatch alarms, log retention, alert routing to Slack and the related runbooks.

• Secure access to ECS, EC2 and RDS: SSM Session Manager instead of SSH, no public endpoints, Secrets Manager, KMS encryption and security group reviews.

• Own IAM Identity Center: permission sets, least privilege and quarterly access reviews.

• Cover Azure as well as AWS while LEA workloads complete their migration.

• Operate Huntress (detections, isolation, policy tuning) and run phishing campaigns and security awareness training.

Application protection

• Make sure every LEA and Distribution application, API and database is protected against attack: WAF, DDoS protection, rate limiting, TLS and no exposed admin interfaces.

• Keep an up-to-date inventory of applications, public endpoints and data flows in scope.

• Review new features and architecture changes for security before release.

Recovery and resilience

• Make sure backups cover all critical systems and are protected against ransomware (immutable or isolated copies).

• Test recovery plans against attack scenarios: restores, failover and rebuild, measured against agreed RTO and RPO targets.

• Keep the incident response and disaster recovery playbooks current and tested.

Incident response

• Take the lead on the technical response if Ancileo is attacked: contain the threat, isolate workloads, rotate credentials and preserve evidence.

• Coordinate with the CTO, the CloudOps team and external responders until systems are restored.

• Run the post-incident review and improve detection and alerting after each incident.

2. CloudOps support (35%)

• Work with the Architecture and CloudOps team on production incidents: ECS task failures, database connectivity, networking and log analysis.

• Support the release process: pre-release checks, change windows and rollback readiness.

• Read and change Terraform for security baselines.

• Write runbooks for recurring issues and fixes.

3. Compliance operations (20%)

• Own the Drata score: weekly triage of failing tests, fix issues on the cloud side and keep evidence current.

• Maintain information security policies and run the annual review and staff acknowledgements.

• Provide technical evidence to auditors (SOC 2, PCI DSS) when requested.

4. IT support (5%)

• Administer Jamf: enrolment, configuration profiles, disk encryption and patch posture.

• Create Google Workspace accounts and access for new hires, and disable and remove access at departures.

Operating cadence

The role runs on a predictable rhythm, with incident and release support on top as needed.

1. Daily : Review GuardDuty, Security Hub and Huntress alerts; check CloudWatch alarms; support releases and incidents with the CloudOps team

2. Weekly : Triage failing Drata tests and fix them; review vulnerability findings (Inspector, ECR image scans); check privileged access

3. Monthly : Access recertification across AWS and key SaaS; phishing campaign or awareness session; security posture report to the CTO

4. Quarterly : IAM and security group review; restore test from an attack scenario; incident response tabletop; Drata scope check against architecture changes

5. Annually : Policy review and staff acknowledgements; technical evidence for SOC 2 and PCI DSS audits; external penetration test coordination and remediation; full recovery plan test

Requirements

Must-have

• 4 to 7 years in cloud, infrastructure or security engineering, including 3+ years hands-on AWS in production.

• Strong AWS security knowledge: IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager.

• Hands-on operation and troubleshooting of ECS, EC2 and RDS.

• Hands-on incident response: detection, containment, evidence collection and recovery.

• Backup and disaster recovery experience, including restore testing.

• Linux administration, networking basics (security groups, NACLs, WAF, DNS) and scripting in Python or Bash.

• Experience operating an EDR product (Huntress, CrowdStrike, SentinelOne or similar).

• Clear written and spoken English, strong documentation and ticket discipline.

Nice-to-have

• AWS Certified Security - Specialty.

• Offensive security testing experience (web applications, APIs, cloud configuration).

• Terraform.

• Azure exposure, especially AKS.

• Drata or Vanta, and experience in a SOC 2 or PCI DSS environment.

• Jamf or another MDM platform.

• Experience in a regulated industry (InsurTech, FinTech, financial services).

What we offer

• Direct reporting line to the CTO and real ownership of cloud security for both business units.

• Hands-on work on production AWS environments serving airlines, OTAs and insurers across Asia-Pacific.

• A small, collaborative engineering team with no heavy hierarchy.

• Hybrid working: 3 days per week in our Kuala Lumpur office.

• Learning budget and support for certifications, including AWS Security - Specialty.

• Competitive salary benchmarked to the Malaysian tech market.