Cybersecurity Engineer (Cloud)

Amentum•Richmond, VA

About The Position

The Cloud Security Engineer implements and maintains security controls across commercial and government cloud environments, including Microsoft 365 Commercial and GCC High, Azure, AWS, hybrid-cloud services, and approved cloud-based artificial intelligence services. The role translates security architecture and regulatory requirements into guardrails, configurations, automation, control evidence, and telemetry. It includes hands-on cloud security engineering, administration of assigned cloud security platforms, risk assessment, control testing, remediation support, and audit readiness. A central responsibility is implementing safeguards for generative AI, machine learning, enterprise copilots, and agentic systems across commercial, government, and CUI environments. The engineer implements and validates technical controls supporting CMMC and applicable NIST requirements, and translates other relevant government, defense-industry, privacy, and international requirements into practical cloud configurations in coordination with Risk and Compliance. The role reports to the Senior Cybersecurity Architect & Senior Manager. It collaborates with cloud platform and application owners, Security Operations, a managed security service provider, and teams across Identity, Network Security, Data Security, Detection and Incident Response, IT, and program sites. The role participates in second-level SOC activities, including responding to critical incidents escalated by an MSSP, and provides infrequent off-hours support as needed. The position does not own underlying cloud services or their remediation queues; other related duties may be assigned.

Requirements

U.S. citizenship is required.
Bachelor's degree in cybersecurity, information technology, computer science, engineering, or a related field, or an equivalent combination of education and relevant experience.
Five years of related experience, including three or more years of relevant experience in cloud, security, systems, or infrastructure engineering.
Hands-on experience with Microsoft cloud or AWS security capabilities and the ability to support Microsoft 365, Azure, AWS, and hybrid services as needed.
Experience implementing or maintaining technical controls through cloud policy, scripting, automation, or infrastructure as code.
Working knowledge of cloud identity, network security, data protection, logging, posture management, and workload protection concepts.
Working knowledge of generative AI and agentic-system security risks, including data exposure, prompt injection, tool and connector permissions, agent identities, secure execution, and audit logging.
Ability to support technical risk assessments, control testing, remediation documentation, and audit evidence collection.
Ability to troubleshoot technical issues, document work clearly, manage priorities, and collaborate with technical and non-technical partners.

Nice To Haves

Experience with a cloud security posture management, workload protection, or cloud-native application protection platform.
Practical experience with, or demonstrated understanding of, Microsoft 365 GCC High or a comparable government cloud environment and the security boundaries associated with regulated data.
Direct experience supporting government, defense-industrial-base, CUI, or other regulated cloud environments.
Working knowledge of government and defense-industry security requirements, including CMMC and NIST SP 800-171 and NIST SP 800-172 concepts.
Familiarity with DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, or comparable regulatory and international requirements.
Hands-on experience securing cloud AI or machine-learning services, enterprise copilots, generative AI applications, retrieval-augmented generation, agents, or automated tool integrations.
A relevant security or cloud certification, such as Security+, an Azure or AWS security certification, CCSP, or comparable training.

Responsibilities

Implement and maintain security controls across Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid services, including cloud guardrails, secure landing zones, workload protections, and virtual desktop environments.
Configure and test security policies, infrastructure-as-code controls, deployment automation, and supporting integrations with cloud platform and application owners.
Review technical findings, troubleshoot control failures, and recommend practical configuration changes that reduce risk without unnecessarily disrupting services.
Administer assigned cloud security posture management and workload protection capabilities, including onboarding environments, configuring policies, monitoring coverage, managing recommendations, and integrating alerts.
Maintain cloud security platform health and configuration, tune controls, document exceptions, and identify coverage gaps.
Integrate cloud security telemetry with Security Operations and the managed security service provider, and support escalated investigations requiring cloud expertise.
Coordinate exposure prioritization and tracking with Vulnerability Management and work with cloud platform owners on remediation.
Implement and validate technical controls supporting CMMC and applicable NIST requirements, including NIST SP 800-171 and NIST SP 800-172.
Support Microsoft 365 GCC High and CUI workloads, accounting for government-cloud service limitations, tenant and security boundaries, data handling requirements, and controlled connectivity with commercial environments.
Translate requirements from DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, and other relevant frameworks into practical cloud configurations with Risk and Compliance.
Perform technical risk assessments and control testing; maintain implementation records, evidence, exceptions, and remediation status for assessments and audits.
Implement and operate security controls for approved AI and machine-learning services, enterprise copilots, generative AI applications, retrieval-augmented generation, agents, and tool integrations.
Configure AI security safeguards, including identity and access controls, data-source permissions, secrets handling, execution boundaries, sandboxing, tool restrictions, human approvals, network egress, and logging.
Test controls against risks including prompt injection, sensitive-data exposure, unsafe tool execution, over-privileged agents, unapproved model or service use, and manipulation of grounding content.
Evaluate AI service configurations and new platform features for security, privacy, data residency, government-cloud availability, and CUI handling before implementation.
Automate repeatable AI security configurations and validation checks through policy, scripting, infrastructure as code, and deployment pipelines where practical.
Integrate relevant AI activity and security telemetry with enterprise monitoring and support investigations requiring AI expertise.
Work with Identity, Network Security, Data Security, Detection and Incident Response, IT, connected program sites, and application teams to implement controls within their areas of responsibility.
Maintain configuration standards, implementation guides, diagrams, operating procedures, and support documentation for assigned cloud security capabilities.
Translate security and regulatory requirements into technical configurations and provide evidence or technical input for assessments and audits when requested.
Stay current on cloud and AI security threats and recommend improvements based on observed risk, platform changes, and operational experience.
Participate in second-level SOC activities, including responding to critical security incidents escalated by an MSSP.
Provide off-hours support on an infrequent, as-needed basis.
Perform other duties as assigned.