Azure Security Engineer

Client is seeking an experienced Azure Security Engineer to define, implement, operate, test, and continuously improve technical security controls across the Microsoft Azure environment. This hands-on security engineering role establishes security requirements, configures and operates Azure security capabilities, monitors cloud security posture, identifies control gaps, and validates remediation. The engineer partners with the Senior Azure Infrastructure & Network Architect, Platform Engineering, IAM, Application Security, Security Operations, and resource-owning teams to ensure Azure infrastructure, applications, identities, networks, data services, containers, and deployment pipelines comply with approved security requirements.

What This Role Owns

• Definition, implementation, operation, testing, and continuous improvement of Azure technical security controls, in partnership with IT Security, Platform Engineering and other resource-owning teams.
• Azure cloud security posture management (CSPM), cloud misconfiguration and vulnerability identification, remediation governance, and security-control validation, while resource-owning teams perform remediation for the resources they own.
• Azure Policy security guardrails, Defender for Cloud, Azure security telemetry, and Azure-focused Sentinel integration.
• Security requirements and validation for Azure network paths, workload exposure, secrets, keys, certificates, and privileged access.
• DevSecOps controls embedded into Terraform and Azure DevOps (ADO) YAML pipelines, including policy checks, pipeline gates, and reusable security modules.
• Azure expertise for escalated cloud security incidents in partnership with Security Operations and the managed SOC.

Key Responsibilities

Cloud Security Engineering & Guardrails

• Define security requirements and partner with Platform Engineering and other resource-owning teams to implement, validate, operate, and continuously improve security controls across Azure workloads and shared platform services.
• Define security requirements for Azure networking and hybrid connectivity in partnership with the Senior Azure Infrastructure & Network Architect
• Assess network designs for segmentation, inspection, private connectivity, ingress, egress, public exposure, and logging requirements
• Validate the security configuration of Private Endpoints, NSGs, Azure Firewall policies, WAF policies, Front Door, API Management, and traffic-monitoring controls
• Identify overly permissive network rules, inspection bypasses, unintended public exposure, weak segmentation, and deviations from approved security requirements
• Validate that corrective actions effectively resolve identified network-security findings
• Monitor network-security control posture and escalate architectural concerns to the Senior Azure Infrastructure & Network Architect
• Develop and maintain secure Azure baselines, implementation standards, and reusable security patterns.
• Implement Azure Policy definitions, initiatives, assignments, exemptions, and remediation tasks to enforce approved requirements.
• Test security controls after deployment and identify control regressions, missing protections, configuration drift, and unintended public exposure.
• Automate repeatable security validation and remediation so recurring weaknesses are addressed through guardrails rather than one-resource-at-a-time fixes.
• Establish clear security acceptance criteria and remediation expectations with Platform Engineering and other resource-owning teams and validate that required controls are implemented before release.

Security Posture & Risk Management

• Administer Microsoft Defender for Cloud and review recommendations, alerts, attack paths, regulatorycompliance assessments, and coverage gaps.
• Identify, prioritize, remediate, and validate Azure security vulnerabilities, configuration weaknesses, excessive privileges, and public-access exposures.
• Perform security reviews of Azure subscriptions, resource groups, networking, storage, Key Vault, application services, databases, AKS, and other cloud services.
• Protect PHI, PII, secrets, credentials, keys, certificates, and other sensitive information across Azure environments.
• Maintain evidence showing findings, corrective actions, validation, exceptions, and closure status.

Identity Security Integration

• Partner with the IAM Engineer to secure Azure identities, permissions, and privileged administrative access and secure identity lifecycle management without duplicating IAM ownership.

• Validate Azure RBAC assignments, least-privilege controls, PIM requirements, and MFA requirements.
• Secure service principals, managed identities, workload identities, and deployment identities.
• Assist with implementation and validation of Conditional Access controls affecting Azure administration.
• Investigate unusual or excessive Azure privileged activity with IAM and Security Operations.
• Recommend managed identities and workload identity patterns where feasible in place of stored credentials.

DevSecOps, IaC & Automation

• Integrate security validation into Terraform and Azure DevOps YAML pipelines and review security-relevant infrastructure changes before prod deployment.
• Design and implement Terraform security scanning, policy validation, compliance checks, secrets scanning, and security gates appropriate to the workload, using reusable modules and policy-as-code patterns.
• Develop automation using PowerShell, Azure CLI, KQL, Logic Apps, Terraform, Bicep, or APIs.
• Validate pipeline service connections and deployment identities for least privilege and appropriate credential handling.
• Drive resource-owning Engineering and Platform teams to remediate findings, validate closure, and make approved security patterns easier to consume through reusable modules, guardrails, and pipeline integrations.

Security Monitoring & Incident Support

• Develop Azure-specific detections, analytics rules, investigations, and monitoring use cases to identify cloud threats, control failures, and suspicious activity.
• Configure and maintain Azure security logging, diagnostic settings, monitoring, and alerting needed for investigation and control validation.
• Integrate Azure security telemetry with Microsoft Sentinel and managed SOC processes and develop or tune Azure-focused detections and KQL queries.
• Provide Azure subject-matter expertise for escalated cloud security alerts and incidents rather than functioning as the primary Tier 1 analyst.
• Support investigation, containment, recovery, evidence preservation, root-cause analysis, and post incident hardening for Azure incidents.
• Convert lessons learned into improved Azure Policy, Terraform, monitoring, detections, or procedures.

AKS & Container Security

• Define and maintain AKS cluster security requirements, container security standards, and approved container security policy controls.
• Harden Azure Container Registry (ACR), including access controls, network exposure, image provenance, vulnerability scanning, retention, and approved image-use requirements.
• Implement and validate container-specific security gates in Azure DevOps YAML pipelines, including image, dependency, Infrastructure as Code, secrets, and policy checks.
• Assess AKS cluster and workload configurations against approved requirements, identify control gaps, and drive resource-owning teams to remediate findings.
• Implement or integrate runtime detection and monitoring for container and Kubernetes threats, suspicious workload behavior, and policy violations.

Compliance, Documentation & Collaboration

• Support Azure technical controls and evidence for HIPAA, SOC 2, URAC, NIST-aligned requirements, internal security standards, and applicable customer obligations.

• Maintain Azure security standards, implementation guidance, runbooks, diagrams, metrics, and remediation records.
• Partner with Infrastructure, DevOps, Application Engineering, Data Engineering, IAM, Application Security, Compliance, Security Operations, and external providers.
• Participate in audits and technical reviews by supplying accurate implementation evidence and remediation status.

• 5+ years of information security experience, including 3+ years of hands-on Azure security engineering

• Demonstrated experience implementing Azure Policy, Defender for Cloud, Azure Monitor, Log Analytics, Sentinel integration, Key Vault, and Azure security controls

• Hands-on experience identifying and remediating Azure vulnerabilities, security misconfigurations, excessive privileges, and public exposures
• Experience implementing security requirements for Azure networking, applications, storage, databases, identities, containers, and platform services
• Strong PowerShell, Azure CLI, KQL, and security-automation experience
• Advanced experience implementing security checks, policy controls, and deployment gates in Azure DevOps YAML pipelines
• Hands-on Terraform security experience, including plan review, policy as code, secrets protection, state security, provider security, and secure module patterns
• Experience securing AKS, ACR, container pipelines, and container runtime environments
• Working knowledge of cloud threat detection, incident investigation, Zero Trust, encryption, least privilege, and regulated cloud environments
• Experience maintaining security evidence, findings, exceptions, remediation records, and controlvalidation results, * Microsoft Certified: Azure Security Engineer Associate (AZ-500) or Cybersecurity Architect Expert (SC100).
• Healthcare, HIPAA-regulated, or other regulated-industry experience.

• Experience with Azure landing zones, GitHub Advanced Security, Microsoft Purview, or complementary cloud-security tooling.

• Experience securing Kubernetes/container environments and cloud-native applications.
• Understanding of NIST CSF, CIS Benchmarks, and MITRE ATT&CK.
• CISSP, CCSP, GIAC, or comparable security certification.
• Master’s or Bachelor’s degree in Information Technology, Information Security, Computer Science, or a related field, or equivalent relevant experience.