Cyber Security Cloud Engineer

National Carwash Solutions•Atlanta, GA

About The Position

The Cyber Security Cloud Engineer is a hands-on role responsible for implementing, operating, and maturing security controls across NCS’s Microsoft Azure and Amazon Web Services environments, as well as enterprise SaaS platforms. The position applies NCS’s NIST-based enterprise security requirements to cloud, SaaS, identity, workload, and data environments, and leads security integration for newly acquired companies. It also helps ensure AI initiatives have appropriate safeguards and partners with Product Engineering and DevOps to implement security controls throughout the software development lifecycle for NCS products, connected equipment, and customer-facing platforms. The engineer collaborates with Infrastructure, Networking, Data, Application Development, business stakeholders, and managed security providers. The role provides technical and executive audiences with clear visibility into control effectiveness, gaps, risk, and remediation progress. Success means delivering required controls on schedule, demonstrating their effectiveness, and reducing enterprise risk while supporting business operations.

Requirements

At least 5 years of progressive IT experience, with broad exposure to infrastructure, networking, identity, and enterprise systems.
At least 3 years of hands-on experience in a dedicated cybersecurity role, including securing production workloads in Microsoft Azure and/or AWS.
Demonstrated experience implementing security controls within an established enterprise security framework, translating control requirements, audit findings, and assessment results into deployed, documented, and measurable controls.
Hands-on experience implementing cloud security services and patterns on at least one major platform (Azure or AWS), and solid familiarity with the other, including IAM, network security, encryption and key management, logging, and workload protection.
Experience with infrastructure as code (such as Terraform, Bicep, or CloudFormation), CI/CD platforms (such as Azure DevOps, GitHub, or GitLab), and application security tooling (SAST/DAST, SCA, secrets scanning, and container scanning).
Track record of partnering with development teams to embed security into the software development lifecycle.
Working knowledge of the NIST Cybersecurity Framework and experience supporting PCI-DSS compliance and audit or assessment processes, including evidence collection and remediation tracking.
Clear, professional written and verbal communication skills, including the ability to report control status, gaps, and remediation progress to technical and non-technical audiences.

Nice To Haves

Current, industry-recognized security certification such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft Certified: Azure Security Engineer Associate (AZ-500); equivalent demonstrated experience is considered.
Direct experience executing security workstreams for mergers, acquisitions, or divestitures, including tenant-to-tenant migrations and identity consolidation.
Experience securing AI/ML platforms and services such as Azure OpenAI, AWS Bedrock, Microsoft 365 Copilot, or enterprise data platforms, and familiarity with the NIST AI RMF, OWASP Top 10 for LLM Applications, or similar frameworks.
Experience with CSPM/CNAPP platforms, container and Kubernetes security, and secrets management.
Experience implementing or maturing a product or application security program, including familiarity with OWASP ASVS and SAMM, NIST SSDF, or similar secure development frameworks, and tools such as GitHub Advanced Security or equivalent integrated DevSecOps platforms.
Experience securing embedded, IoT, or payment-enabled products, including PCI-DSS considerations for software and device design.
Scripting and automation proficiency in PowerShell, Python, or similar tools for detection engineering and security tooling.
Experience in manufacturing, distribution, or field service environments, including connected equipment and payment systems.

Responsibilities

Implement and maintain security controls across Azure and AWS, including identity and access management, network segmentation, encryption and key management, logging, and workload protection.
Deploy and operate CSPM/CNAPP, infrastructure-as-code guardrails, policy-as-code, and automated compliance checks to enforce baselines and provide evidence of control effectiveness.
Operate and tune cloud-native security services and integrate cloud telemetry into enterprise SIEM detection and response workflows.
Conduct detection engineering and incident response for cloud-hosted and identity-centric threats, including alert triage, investigation, root cause analysis, containment, and remediation coordination; track emerging cloud attack techniques and recommend updates to detections, hardening, and response procedures.
Support cybersecurity due diligence for acquisitions by assessing target environments and documenting gaps against NCS security requirements for prioritized integration plans.
Securely integrate and migrate acquired companies onto NCS platforms, including identity consolidation into Microsoft Entra ID, Microsoft 365 tenant-to-tenant migrations, Azure and AWS workload migrations, network and endpoint onboarding, and legacy infrastructure decommissioning.
Maintain and follow documented integration playbooks and security baselines, bringing acquired entities to the required security standard within defined timelines and reporting status.
Implement and operate CI/CD security controls with Product Engineering and DevOps, including SAST/DAST, software composition analysis, secrets scanning, container image scanning, and SBOM generation, with risk-based release gates.
Support secure development for NCS software, connected equipment, and customer-facing platforms through threat modeling, secure design reviews, secure coding standards, API security, and vulnerability management, particularly for payment-enabled and field-deployed systems.
Track product security metrics, maintain developer-facing documentation, and uphold remediation SLAs that establish clear ownership of security findings.
Implement data protection, DLP, identity governance, and access controls to securely enable approved AI initiatives in partnership with Data, IT, and business teams.
Maintain security controls across Microsoft 365, identity, Windows and Apple endpoints, and cloud platforms in line with NCS requirements.
Produce evidence, metrics, and documentation for PCI-DSS compliance, NIST CSF alignment, internal and external audits, executive security reviews, and customer security assessments.
Mentor engineers, serve as an escalation point for complex cloud and identity security issues, and report control status, gaps, risk, and remediation progress to technical and executive audiences.
Participate periodically in after-hours incident response or maintenance windows and occasionally travel to NCS facilities and acquired-company locations for integration activities.