Gwaabe Sama

About Gwaabe Sama

8+ years in cloud security. 200+ AWS and Azure accounts secured, with zero reported…

Experience

1. Senior Cloud Security Engineer

   Amazon

   Apr 2021 — Present · OK, US

   Architect and govern multi-cloud security across 200+ AWS accounts using AWS Control Tower, Organizations, and Account Factory for Terraform (AFT), embedding GuardDuty, Security Hub, Config rules, and CloudTrail automatically on every new account, reducing onboarding time by 60% and ensuring Day-1 compliance.• Design DevSecOps pipelines integrating SAST (Checkmarx, SonarQube), SCA (Snyk), IaC scanning (Checkov, tfsec), and container image scanning (Trivy) as automated CI/CD gates, reducing production security vulnerabilities by 40%.• Enforce Kubernetes security across EKS clusters using OPA Gatekeeper, Pod Security Standards, Falco runtime detection, and CrowdStrike Falcon Container, preventing privileged container deployments and detecting anomalous behavior in real time.• Build Splunk risk-based alerting (RBA) and correlation rules to detect IAM privilege escalation, unauthorized API calls, and lateral movement, reducing alert fatigue by 50% while improving threat detection fidelity.• Engineer zero-trust network design with AWS Network Firewall, WAF rule groups, and Istio mTLS for inter-service pod encryption across EKS clusters, eliminating implicit trust across all cloud workloads.• Develop Python Lambda functions and AWS Step Functions for automated incident response — public S3 bucket remediation, IAM key revocation, security group lockdown, and instance isolation — cutting manual containment time from hours to minutes.• Lead SOC 2 Type II and NIST 800-53 compliance programs, automating evidence collection via Python and Boto3 and cutting audit preparation time by 70%.• Mentor 5+ junior and mid-level security engineers through code reviews and architecture walkthroughs; lead a security champions program training 25+ developers on threat modeling and DevSecOps practices.• Present cloud security risk metrics and compliance posture to C-level executives in quarterly security reviews, translating technical risk into measurable business impact.