Senior Security Consultant – AWS Cloud Architecture
at Gruve
Pune, Maharashtra, India, onsite, senior, full time, 8+ years
posted 16 Sept 2026
- AWS Route 53
- AWS CloudWatch
- AWS VPC
- AWS Network Firewall
- tfsec
- AWS Config
- AWS IAM Identity Center
- Terraform
- Cisco ISE
- AWS Control Tower
- AWS
- AWS VPN
- AWS Direct Connect
- AWS KMS
- AWS Account Factory
- AWS CloudTrail
- AWS Transit Gateway
- AWS Systems Manager
- Git
- RADIUS
- AWS Organizations
- Ansible
- Checkov
- AWS IAM
- Infrastructure-as-Code
- AWS GuardDuty
- AWS Security Hub
- AWS Cost Explorer
- Kubernetes
About the role
Posted: 2026-09-16
About Gruve
Gruve is an innovative software services startup dedicated to transforming enterprises to AI powerhouses. We specialize in cybersecurity, customer experience, cloud infrastructure, and advanced technologies such as Large Language Models (LLMs). Our mission is to assist our customers in their business strategies utilizing their data to make more intelligent decisions. As a well-funded early-stage startup, Gruve offers a dynamic environment with strong customer and partner networks.
AWS Cloud Architect responsible for designing, building, and owning the complete AWS foundation for Gruve's Cisco ISE-as-a-Service (ISEaaS) multi-tenant managed service, with 8+ years of experience in cloud infrastructure and network security environments. Owns the AWS Organization and multi-account landing zone, tenant network architecture, security guardrails, Infrastructure-as-Code, and cloud cost management. This is a hands-on build role: the successful candidate will personally author Terraform modules and design the account structure that every customer tenant is provisioned from, while applying reliability engineering practices to reduce operational toil. Working knowledge of Cisco ISE, RADIUS, and enterprise network security concepts.
What you would do
- Design and implement multi-account AWS Organization structure, including Organizational Units (OUs), management account separation, and consolidated billing.
- Design and enforce Service Control Policies (SCPs) and organization-level guardrails for tenant isolation and compliance.
- Design tenant network architecture: VPC, multi-AZ subnet design, route tables, VPC endpoints, NAT, DNS (Route 53 private zones including PTR records), and IP address management (IPAM).
- Design, implement and maintain centralized AWS egress architectures using AWS Network Firewall, NAT Gateways and Transit Gateway to enforce consistent outbound traffic controls, security policies, traffic inspection and centralized logging across multi-account environments.
- Implement AWS Transit Gateway hub-and-spoke connectivity with per-tenant route tables, Site-to-Site VPN, and Direct Connect.
- Implement AWS security services: IAM and IAM Identity Center (SSO), KMS customer-managed keys, CloudTrail, AWS Config, GuardDuty, and Security Hub.
Read from job-boards.greenhouse.io, last seen 3d ago.