Cloud Security Engineer

We are seeking an experienced Senior Cloud Security Engineer (Sr. CSE) to serve as a cloud security subject matter expert supporting a large-scale enterprise, Microsoft Azure migration. In this role, you will be responsible for architecting, implementing, securing, and continuously monitoring cloud environments and computing infrastructure in alignment with SEC530 principles, Zero Trust architecture, and enterprise compliance frameworks.

You will provide senior-level technical leadership across cloud security architecture, IAM, network security, threat monitoring, vulnerability management, incident response, and governance. This role collaborates closely with Cloud Engineering, Network Engineering, SOC, Enterprise Architecture, DevOps, and IT leadership to ensure all environments remain resilient, compliant, and secure., * Cloud Architecture & Hardening: Lead complex cloud security initiatives, assist in designing secure cloud architectures for complex enterprise systems, and implement robust security gates within deployment pipelines to prevent insecure configurations from reaching production.

• Policy & Automation: Develop and enforce Azure Policies to ensure standardization and adherence to enterprise compliance mandates. Build Azure Automation runbooks to streamline and automate incident response workflows.
• Risk & Vulnerability Management: Proactively identify cloud security vulnerabilities, evaluate risk based on business impact, prioritize and track remediation workflows, and validate corrective actions.
• Network & Access Controls: Review and validate firewall and Network Security Group (NSG) rule change requests against strict enterprise security baselines. Define security topologies, IP schemes, and access controls.
• Security Monitoring & Incident Response: Monitor security telemetry using enterprise SIEM tools, partner closely with Security Operations Center (SOC) teams to coordinate responses, and lead investigations and containment efforts for cloud-related security incidents.
• Diagnostics & Forensics: Identify and diagnose complex system threats and anomalies utilizing system logs, line monitors, SIEM platforms, diagnostic software, and test utilities.
• Audits, Compliance & Governance: Assess cloud security gaps, recommend remediations, maintain comprehensive technical and security documentation, generate audit evidence, and support formal compliance assessments.
• Stakeholder Advisory: Effectively articulate complex technical risks and mitigation strategies to technical teams as well as non-technical leadership.

• Proven track record serving as a Lead or Senior Cloud Security Engineer within complex enterprise environments.
• Deep technical expertise in Microsoft Azure security services, governance, and architecture (Azure Policy, Defender for Cloud, Microsoft Sentinel/SIEM, Azure Automation runbooks, NSGs, and virtual networks).
• Hands-on implementation experience with Zero Trust architecture and defensible security architecture principles (e.g., SEC530 framework).
• Strong background in vulnerability management, log analysis, threat hunting, and security incident response.
• Experience integrating security validation into CI/CD pipelines and DevOps workflows.
• Demonstrated ability to create clear architectural topology diagrams, technical documentation, and IP scheme documentation.
• Strong communication skills with the ability to operate independently and lead enterprise-wide security initiatives.
• Position Type: Long-Term Contract
• Location: Mechanicsville, VA (Hybrid)

Required / Desired Skills

• Enterprise Cloud Experience (Required 8 Years)
• Enterprise Cloud Security Experience (Required 5 Years)
• Candidate must be highly experienced as a cloud security professional with strong hands-on expertise in cloud infrastructure and cloud engineering (Required 2 Years)
• Candidatte must be highly experienced in cybersecurity, networking, identity, security operations, and have a deep cloud engineering competency (Required 2 Years)
• Candidate must have in-depth experience moving between strategic architecture and hands-on engineering and identifying security risks (Required 2 Years)
• Candidate must have in-depth experience designing practical solutions, implementing controls, and working with infrastructure teams (Required 2 Years)
• Candidate musth have in-depth experience working with application teams to continuously improve the organization’s cloud security posture (Required 2 Years)
• Candidate must have experience setting up Network Security Groups (NSGs), resource manager and management groups, monitor and log analytics, (Required 2 Years)
• Candidate must have experience setting up Azure Firewall, Azure WAF, Azure Monitor, Application Gateways, virtual networks and network segmentation. (Required 2 Years)
• Candidate must have experience developing Azure Policy to enforce standardization and compliance with enterprise requirements (Required 2 Years)
• Candidate must have experience in Cloud Workload Protection (CWPP) and Cloud-Native Application Protection Platform (CNAPP) (Required 2 Years)
• Candidate must have experience in cloud risk assessment and prioritization, attack surface management, and Cloud Security Posture Management (VSPM) (Required 2 Years)
• Candidate must have experience in cloud vulnerability management, remediation tracking, and risk assessment and prioritization (Required 2 Years)
• Candidate must have experience with; SEC530, CIS Benchmarks, NIST CSF, NIST 800-53, Zero Trust principles (Required 2 Years)
• Candidate must have experience collaborating with the security governance team and application leads to implement enterprise log management standards. (Required 2 Years)
• Candidate must also have hands on expertise validating indexer parsers, leveraging Splunk Query Language for monitoring and data analysis. (Required 2 Years)
• Candidate must have experience with log management, security analytics, SOC integration, Threat detection, and Threat hunting (Required 2 Years)
• Candidate must have experience with the SIEM products (e.g. Splunk, Microsoft Sentinel, CNAPP), (Required 2 Years)
• Candidate must have experience securing enterprise cloud environments and implementing security controls in production environments (Required 2 Years)
• Candidate must have experience in vulnerability management, remediation tracking, vulnerability scanning tools (e.g. Nessus, Tenable, Defender) (Required 2 Years)
• Candidate must have experiences coordinating during cyber incidents (Required 2 Years)
• Candidate must have experiences in: Incident response, Security investigations, Log analysis, Threat intelligence, Security monitoring, IOC analysis (Required 2 Years)
• Candidate must have experience creating Azure Automation runbooks to support incident response workflows. (Required 2 Years)
• Candidate must have experience with Identity and access management (IAM), Role-based Access control (RBAC), and Privileged Access Management (PAM) (Required 2 Years)
• Candidate must have experience with Least-privilege access and multi-factor authentication (Required 2 Years)
• Candidate must have experience working in highly regulated environments with large government agencies or similar regulatory environments. (Required 2 Years)
• Candidate must have ability to communicate technical issues to technical, non-techical, and executive audiences. (Required 2 Years)
• Candidate must have ability mentor junior engineers. (Required 2 Years)
• Required: Azure Security Engineer Associate, Security+, Certified Cloud Security Professional certifications (Required 2 Years)
• Preferred: CCSP, Designing Microsoft Azure Infrastructure (AZ-305) (Desired 1 Years)