Senior Cloud Security Engineer

Nexiva•Mechanicsville, VA

1d•Hybrid

About The Position

The Senior Cloud Security Engineer will implement and support the agency’s cloud and computing infrastructure, serving as a subject matter expert for the enterprise Azure migration. The role architects, implements, and secures cloud environments in alignment with SEC530 principles, Zero Trust, and enterprise compliance frameworks. It provides senior-level technical leadership across cloud security architecture, identity and access management, network security, security monitoring, vulnerability management, incident response, and cloud governance. The engineer works closely with Cloud Engineering, Network Engineering, Security Operations, Enterprise Architecture, Infrastructure, Application Development, DevOps, Risk Management, and IT leadership to keep cloud environments secure, resilient, compliant, and aligned with enterprise security standards. The position is a long-term contract based in Mechanicsville, Virginia, with a hybrid work arrangement and an in-person interview process.

Requirements

At least 8 years of enterprise cloud experience.
At least 5 years of enterprise cloud security experience.
Strong hands-on expertise in cloud infrastructure, cloud engineering, cybersecurity, networking, identity, and security operations.
Experience moving between strategic architecture and hands-on engineering, identifying security risks, designing practical solutions, implementing controls, and working with infrastructure and application teams.
Experience setting up Network Security Groups (NSGs), resource managers and management groups, monitoring and log analytics.
Experience with Azure Firewall, Azure WAF, Azure Monitor, Application Gateways, virtual networks, and network segmentation.
Experience in incident response, security investigations, log analysis, threat intelligence, security monitoring, IOC analysis, and coordinating during cyber incidents.
Experience in vulnerability management, remediation tracking, vulnerability scanning tools such as Nessus, Tenable, or Defender, and risk assessment and prioritization.
Experience securing enterprise cloud environments and implementing security controls in production.
Experience with SIEM products such as Splunk, Microsoft Sentinel, or CNAPP; log management, security analytics, SOC integration, threat detection, and threat hunting.
Hands-on expertise validating indexer parsers and using Splunk Query Language for monitoring and data analysis.
Experience collaborating with security governance teams and application leads to implement enterprise log management standards.
Experience with SEC530, CIS Benchmarks, NIST CSF, NIST 800-53, and Zero Trust principles.
Experience with attack surface management, Cloud Security Posture Management (VSPM), Cloud Workload Protection (CWPP), and Cloud-Native Application Protection Platform (CNAPP).
Experience developing Azure Policy and creating Azure Automation runbooks for incident response workflows.
Experience with identity and access management (IAM), role-based access control (RBAC), privileged access management (PAM), least-privilege access, and multi-factor authentication.
Experience working in highly regulated environments, such as large government agencies or similar regulatory environments.
Ability to communicate technical issues to technical, non-technical, and executive audiences.
Ability to mentor junior engineers.
Required certifications: Azure Security Engineer Associate, Security+, and Certified Cloud Security Professional (CCSP).

Nice To Haves

CCSP certification (also listed among required certifications).
Designing Microsoft Azure Infrastructure (AZ-305) certification.

Responsibilities

Identify cloud security vulnerabilities, assess risks based on business impact, prioritize remediation, track remediation activities, and validate corrective actions.
Lead complex cloud security initiatives, provide technical direction to engineers, and assist with secure architecture design for complex enterprise environments.
Influence architecture and security decisions, prevent insecure configurations from reaching production, and implement security gates in deployment pipelines.
Explain complex security risks to non-technical stakeholders.
Assess cloud security risks and gaps, recommend remediations, and review proposed cloud solutions to define appropriate security and compensating controls.
Create and maintain security documentation and evidence, and support audits and assessments.
Develop Azure policies to enforce standardization and compliance with enterprise requirements.
Create Azure Automation runbooks to support incident response workflows.
Monitor security events using SIEM technologies and coordinate incident response activities with the SOC team.
Identify and diagnose system problems and threats using system logs, line monitors, SIEM, diagnostic software, and test equipment.
Lead investigation and containment of cloud security incidents.
Review firewall and NSG rule requests and ensure compliance with security standards.
Provide documentation, architecture topology diagrams, IP schemes, and access controls when required.
Work independently on assigned projects.
Collaborate with infrastructure and application teams to design and implement cloud security controls and continuously improve the organization’s cloud security posture.
Support cloud log management, security analytics, SOC integration, threat detection, and threat hunting, including validating indexer parsers and using Splunk Query Language for monitoring and data analysis.
Mentor junior engineers.