Cyber Security Cloud Engineer

National Carwash Solutions•Atlanta, GA

23h

About The Position

The Cyber Security Cloud Engineer is the hands-on engineer responsible for implementing, operating, and maturing security controls across NCS’s cloud environment, including Microsoft Azure, Amazon Web Services, and enterprise SaaS platforms. The role implements controls protecting cloud, SaaS, identity, workload, and data environments within NCS’s established NIST-based enterprise security requirements. It also leads security integration for newly acquired companies and helps ensure AI initiatives have appropriate safeguards. In partnership with Product Engineering and DevOps, the engineer puts security controls into practice across the software development lifecycle for NCS products, connected equipment, and customer-facing platforms. The engineer works closely with Infrastructure, Networking, Data, Application Development, and business stakeholders, and provides security leadership with clear visibility into control status, gaps, and remediation progress. Success means delivering required controls on schedule, demonstrating their effectiveness, and reducing enterprise risk without slowing the business. NCS is a North American industrial products, services, and technology company serving car wash operators. It provides manufactured equipment, installation services, aftermarket parts and services, chemicals, and software. The company has approximately 1,600 or more employees and six manufacturing plants across North America, with primary corporate offices in Des Moines, Iowa, and Dallas, Texas. Applicants must be eligible to work in the United States; visa sponsorship is not currently available.

Requirements

At least 5 years of progressive IT experience, with broad exposure to infrastructure, networking, identity, and enterprise systems.
At least 3 years of hands-on experience in a dedicated cybersecurity role, including securing production workloads in Microsoft Azure and/or AWS.
Experience implementing security controls within an established enterprise security framework and translating control requirements, audit findings, and assessment results into deployed, documented, measurable controls.
Hands-on experience with cloud security services and patterns on at least one major platform (Azure or AWS), and solid familiarity with the other, including IAM, network security, encryption and key management, logging, and workload protection.
Experience with infrastructure as code such as Terraform, Bicep, or CloudFormation; CI/CD platforms such as Azure DevOps, GitHub, or GitLab; and application security tools such as SAST/DAST, SCA, secrets scanning, and container scanning.
A track record of partnering with development teams to embed security into the SDLC.
Working knowledge of the NIST Cybersecurity Framework and experience supporting PCI-DSS compliance and audit or assessment processes, including evidence collection and remediation tracking.
Clear, professional written and verbal communication and the ability to report control status, gaps, and remediation progress to technical and non-technical audiences.
Ability to work primarily in an office-based or remote-office setting using a computer and standard office equipment for extended periods, and communicate effectively by phone, video, and in person.

Nice To Haves

One or more current, industry-recognized security certifications, such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft Certified: Azure Security Engineer Associate (AZ-500); equivalent demonstrated experience is considered.
Direct experience executing cybersecurity workstreams for mergers, acquisitions, or divestitures, including tenant-to-tenant migrations and identity consolidation.
Experience securing AI/ML platforms and services such as Azure OpenAI, AWS Bedrock, Microsoft 365 Copilot, or enterprise data platforms, and familiarity with the NIST AI RMF, OWASP Top 10 for LLM Applications, or similar frameworks.
Experience with CSPM/CNAPP platforms, container and Kubernetes security, and secrets management.
Experience implementing or maturing a product or application security program, including familiarity with OWASP ASVS and SAMM, NIST SSDF, or similar frameworks, and tools such as GitHub Advanced Security or equivalent DevSecOps platforms.
Experience securing embedded, IoT, or payment-enabled products, including PCI-DSS considerations for software and device design.
Scripting and automation proficiency, such as PowerShell or Python, for detection engineering and security tooling.
Experience in manufacturing, distribution, or field service environments, including connected equipment and payment systems.

Responsibilities

Implement and maintain Azure and AWS security controls in accordance with NCS requirements, including identity and access management, network segmentation, encryption and key management, logging, and workload protection.
Deploy and operate CSPM/CNAPP, infrastructure-as-code guardrails, policy-as-code, and automated compliance checks to enforce baselines and provide continuous evidence of control effectiveness.
Operate and tune cloud-native security services, including Microsoft Defender for Cloud, Microsoft Sentinel, Entra ID Protection, AWS GuardDuty, Security Hub, CloudTrail, and IAM Access Analyzer, and integrate telemetry into enterprise SIEM detection and response workflows.
Conduct detection engineering and incident response for cloud-hosted and identity-centric threats, including alert triage, investigation, root cause analysis, containment, and remediation coordination with managed security providers; recommend updates based on emerging attack techniques.
Support cybersecurity due diligence for acquisitions by assessing target environments and documenting gaps against NCS security requirements.
Securely integrate and migrate acquired companies to NCS platforms, including identity consolidation into Microsoft Entra ID, Microsoft 365 tenant-to-tenant migrations, Azure and AWS workload migrations, network and endpoint onboarding, and legacy infrastructure decommissioning.
Maintain documented integration playbooks and security baselines, bring acquired entities to required security standards within defined timelines, and report integration status.
Implement and operate CI/CD security controls with Product Engineering and DevOps, including SAST/DAST, software composition analysis, secrets scanning, container image scanning, SBOM generation, and risk-based release gates.
Support secure product development through threat modeling, secure design reviews, secure coding standards, API security, and vulnerability management, with attention to payment-enabled and field-deployed systems.
Track product security metrics, maintain developer-facing documentation, and uphold remediation SLAs that provide engineering teams clear ownership of findings.
Implement data protection, DLP, identity governance, and access controls for approved AI initiatives, including Microsoft 365 Copilot, Azure OpenAI, AWS Bedrock, and enterprise AI tooling.
Maintain controls across Microsoft 365, identity, Windows and Apple endpoints, and cloud platforms; produce evidence, metrics, and documentation for PCI-DSS, NIST CSF alignment, audits, executive reviews, and customer security assessments.
Mentor engineers, serve as the escalation point for complex cloud and identity security issues, and communicate control status, gaps, risk, and remediation progress to technical and executive audiences.
Participate periodically in after-hours incident response or maintenance windows and occasionally travel to NCS facilities and acquired-company locations.