Senior Cloud Security Engineer

Senior Cloud Security Engineer

Location: Mechanicsville, VA
Work Arrangement: Hybrid
Position Type: Contract, 8+ months with potential extension or conversion to full-time
Job ID: 813222
Industry: State Government / Transportation Infrastructure

This opportunity is designed for an experienced cloud or security engineer ready to take broader ownership of enterprise cloud security architecture, engineering controls, and risk remediation.

You will support a large-scale Microsoft Azure migration for a state transportation organization, helping secure cloud infrastructure as it evolves. The work spans Azure security architecture, identity and access management, network security, security monitoring, vulnerability management, incident response, and compliance.

This is not solely a SOC monitoring role or a cloud administration position. The focus is on designing security controls, implementing them in production, identifying enterprise risks, and working directly with infrastructure, application, and security teams to resolve them.

Azure Security Architecture and Engineering

• Design, implement, and secure enterprise Azure environments supporting cloud migration and production workloads.

• Configure and strengthen Azure networking controls, including Virtual Networks, Network Security Groups (NSGs), Azure Firewall, Web Application Firewall (WAF), Application Gateway, and network segmentation.

• Develop Azure Policy definitions, management group controls, and governance standards to enforce security baselines.

• Build Azure Automation runbooks to support incident response and repeatable remediation workflows.

• Apply Zero Trust principles, least-privilege access, RBAC, privileged access management, and multifactor authentication.

Cloud Threat Detection and Incident Response

• Investigate cloud security events, analyze logs, assess indicators of compromise, and coordinate incident containment with Security Operations teams.

• Work with Microsoft Sentinel, Splunk, and other SIEM or cloud security platforms to improve visibility, threat detection, and security analytics.

• Use Splunk Search Processing Language (SPL) to analyze security data and validate log ingestion and parsing.

• Support threat hunting, threat intelligence analysis, and incident investigations.

Vulnerability Management and Risk Reduction

• Identify cloud misconfigurations, security vulnerabilities, and weaknesses in enterprise cloud architecture.

• Assess business impact, prioritize remediation, track corrective actions, and validate fixes.

• Use tools such as Microsoft Defender for Cloud, Tenable, or Nessus to support vulnerability management and cloud security assessments.

• Evaluate cloud security posture management (CSPM), cloud workload protection (CWPP), and cloud-native application protection platform (CNAPP) capabilities.

Enterprise Collaboration and Technical Leadership

• Review proposed cloud designs, firewall changes, access controls, and deployment configurations before production implementation.

• Integrate security requirements and enforcement gates into deployment pipelines and DevOps workflows.

• Collaborate with cloud engineering, networking, application development, infrastructure, enterprise architecture, risk management, and security governance teams.

• Maintain architecture diagrams, network topology, IP addressing schemes, access-control documentation, and audit evidence.

• Explain technical risks and remediation priorities to engineers, business stakeholders, and executive audiences.

• Provide technical direction and mentorship to other engineers while independently driving assigned initiatives.

• 8+ years of enterprise cloud experience.

• 5+ years of enterprise cloud security experience.

• Strong hands-on experience with Microsoft Azure infrastructure and production cloud security.

• Experience designing secure cloud architectures and implementing security controls across enterprise environments.

• Practical knowledge of Azure networking, NSGs, Azure Firewall, WAF, Application Gateway, Azure Monitor, Log Analytics, and management groups.

• Experience with Azure Policy, cloud governance, and Azure Automation runbooks.

• Strong knowledge of IAM, RBAC, PAM, least privilege, and MFA.

• Experience with SIEM, security analytics, log management, threat detection, and SOC integration, particularly Microsoft Sentinel and/or Splunk.

• Hands-on Splunk SPL and security log analysis experience.

• Experience with incident response, security investigations, threat intelligence, IOC analysis, and cyber incident coordination.

• Experience with cloud vulnerability scanning, risk prioritization, remediation tracking, and cloud security posture management.

• Familiarity with CNAPP, CWPP, and enterprise cloud workload protection.

• Knowledge of SEC530 principles, CIS Benchmarks, NIST Cybersecurity Framework, NIST SP 800-53, and Zero Trust.

• Experience in government, highly regulated, or comparable enterprise environments.

• Strong communication skills and the ability to work independently while collaborating across technical teams.

The supplied requirements list the following certifications:

• Microsoft Certified: Azure Security Engineer Associate

• CompTIA Security+

• Certified Cloud Security Professional (CCSP)

Preferred: Microsoft Azure architecture expertise aligned with AZ-305.