IT Security Engineer - Cloud

CMG Financial

30d•Remote

About The Position

CMG Financial is hiring a Security Engineer for our cloud environment to help secure our Azure-primary cloud and the hybrid environment that supports one of the nation's largest privately held mortgage lenders. Working within the Information Security team, you will harden cloud posture, tighten identity and access, and build the detection and automation that keep our environment defensible. This role is built for growth: you will own meaningful cloud security work from the start and expand your scope and depth over time. It operates in a highly regulated lending environment, subject to regulatory examinations and investor and agency audits.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or a related field, or equivalent practical experience.
3+ years in cloud security or cloud engineering, including hands-on Microsoft Azure security.
Microsoft Defender for Cloud, Azure Policy, and Microsoft Entra ID (Azure RBAC, PIM, Conditional Access).
Cloud security posture management (CSPM/CNAPP), with the ability to find and remediate misconfigurations and excessive access.
Infrastructure-as-Code with Terraform and CI/CD security in GitHub Actions.
Scripting and automation with Python, PowerShell, and KQL. Using GenAI to generate and validate scripts is welcomed and approved.
Microsoft Sentinel, including Log Analytics ingestion (data connectors, DCR/DCE).
Security architecture, design review, and threat modeling, with working knowledge of NIST CSF and CIS Benchmarks.

Nice To Haves

Hands-on AWS security (the role is Azure-primary; AWS is a plus).
GitHub Advanced Security (GHAS); container and Kubernetes (AKS) security.
Secrets and key management (Azure Key Vault).
Experience in financial services, mortgage, or other highly regulated industries, including producing audit and examination evidence.

Responsibilities

Operate and tune Microsoft Defender for Cloud (CSPM/CNAPP) across Azure subscriptions, remediating misconfigurations and excessive access.
Enforce preventative guardrails with Azure Policy and benchmark configuration against CIS Benchmarks and the NIST Cybersecurity Framework.
Apply least-privilege access in Microsoft Entra ID using Azure RBAC, PIM, and Conditional Access, and run periodic access reviews and attestations.
Use Microsoft Purview and Defender for Cloud data-aware posture (DSPM) to classify and protect sensitive cloud data.
Embed security into Terraform and GitHub Actions pipelines, including IaC scanning, policy-as-code, and secrets management.
Support threat modeling and secure design reviews for new and changing cloud workloads.
Engineer Microsoft Sentinel data ingestion (data connectors, Data Collection Rules and Endpoints) and build detections.
Integrate Microsoft Defender for Cloud and Defender XDR signals into Sentinel for unified detection and response.
Support cloud threat hunting, incident response, and automation of enrichment and remediation.
Map cloud controls to recognized frameworks and produce control evidence for regulatory examinations and investor and agency audits.