Senior Cloud Security Engineer

Nexiva•Mechanicsville, VA

1d•Hybrid

About The Position

The Senior Cloud Security Engineer will implement and support the agency’s cloud and computing infrastructure and serve as a subject matter expert for the enterprise Azure migration. The role is responsible for architecting, implementing, securing, monitoring, and continuously improving enterprise cloud environments in alignment with SEC530 principles, Zero Trust, and enterprise compliance frameworks. The position provides senior-level technical leadership across cloud security architecture, identity and access management, network security, security monitoring, vulnerability management, incident response, and cloud governance. The engineer works with cloud and network engineering, security operations, enterprise architecture, infrastructure, application development, DevOps, risk management, and IT leadership to keep cloud environments secure, resilient, compliant, and aligned with enterprise standards.

Requirements

At least 8 years of enterprise cloud experience.
At least 5 years of enterprise cloud security experience.
Strong hands-on expertise in cloud infrastructure, cloud engineering, cybersecurity, networking, identity, and security operations.
Experience moving between strategic architecture and hands-on engineering, identifying security risks, designing practical solutions, implementing controls, and working with infrastructure and application teams to improve cloud security posture.
Experience with Azure Network Security Groups (NSGs), Resource Manager, management groups, monitoring, and Log Analytics.
Experience with Azure Firewall, Azure WAF, Azure Monitor, Application Gateways, virtual networks, and network segmentation.
Experience with incident response, security investigations, log analysis, threat intelligence, security monitoring, IOC analysis, and coordination during cyber incidents.
Experience in vulnerability management, remediation tracking, vulnerability scanning tools such as Nessus, Tenable, or Defender, and risk assessment and prioritization.
Experience securing enterprise cloud environments and implementing security controls in production.
Experience with SIEM products such as Splunk, Microsoft Sentinel, or CNAPP, as well as log management, security analytics, SOC integration, threat detection, and threat hunting.
Hands-on experience validating indexer parsers and using Splunk Query Language for monitoring and data analysis.
Experience collaborating with security governance teams and application leads to implement enterprise log management standards.
Experience with SEC530, CIS Benchmarks, NIST CSF, NIST 800-53, and Zero Trust principles.
Experience with attack surface management, Cloud Security Posture Management (VSPM), Cloud Workload Protection (CWPP), and Cloud-Native Application Protection Platform (CNAPP).
Experience developing Azure Policy and creating Azure Automation runbooks for incident response workflows.
Experience with identity and access management (IAM), role-based access control (RBAC), privileged access management (PAM), least-privilege access, and multi-factor authentication.
Experience working in highly regulated environments, such as large government agencies or similar regulatory environments.
Ability to communicate technical issues to technical, non-technical, and executive audiences.
Required certifications: Azure Security Engineer Associate, Security+, and Certified Cloud Security Professional.
Local candidates only; an in-person interview is required.

Nice To Haves

CCSP certification.
Designing Microsoft Azure Infrastructure (AZ-305) certification.

Responsibilities

Identify cloud security vulnerabilities, assess risk based on business impact, prioritize remediation, track remediation activities, and validate corrective actions.
Lead complex cloud security initiatives, provide technical direction to engineers, and assist with designing secure cloud architectures for complex enterprise environments.
Influence architecture and security decisions, prevent insecure configurations from reaching production, and implement security gates within deployment pipelines.
Explain complex security risks to non-technical stakeholders.
Assess cloud security risks and gaps and recommend remediations; create and maintain security documentation and evidence; and support audits and assessments.
Review proposed cloud solutions for security risks and define appropriate security and compensating controls.
Develop Azure policies to enforce standardization and enterprise requirements, and create Azure Automation runbooks to support incident response workflows.
Monitor security events using SIEM technologies and coordinate incident response activities with the client’s SOC team.
Identify and diagnose system problems and threats using system logs, line monitors, SIEM, diagnostic software, and test equipment.
Lead the investigation and containment of cloud security incidents.
Review firewall and Network Security Group (NSG) rule requests and ensure they comply with security standards.
Provide documentation, architecture topology diagrams, IP schemes, and access controls when required.
Work independently on assigned projects.
Mentor junior engineers.