We are seeking a Senior Cloud Security Engineer to serve as a Subject Matter Expert (SME) supporting the enterprise Azure cloud migration in Mechanicsville, VA. This hybrid role provides senior-level technical leadership across cloud security architecture, identity and access management (IAM/RBAC/PAM), network security (Azure Firewall, WAF, NSGs, App Gateways), vulnerability management, and incident response. The engineer will align cloud environments with SEC530, Zero Trust, NIST 800-53, and CIS Benchmarks, build automated Azure Policy guardrails, create Azure Automation runbooks, and integrate security telemetry with Microsoft Sentinel and Splunk SIEM platforms.
Location: 9120 Lockwood Boulevard, Mechanicsville, VA 23116
Work Arrangement: Hybrid
Role Type: Contract (11/09/2026 – 06/30/2027)
Submission Deadline: Friday, October 23, 2026
Interview Process: Phone or In-Person Interview
Shift: EST Business Hours
Work Authorization Note: Candidates must physically reside within the United States (Commonwealth of Virginia security policy prohibiting offshore contractors).
Key Responsibilities
Cloud Architecture & Zero Trust Engineering: Architect, implement, and secure enterprise Azure cloud environments aligning with Zero Trust, SEC530, NIST CSF/800-53, and CIS Benchmarks.
Policy Guardrails & Automation: Develop custom Azure Policies to enforce compliance and standardization; build Azure Automation runbooks for automated incident response workflows and security guardrails within deployment pipelines.
Network & Boundary Security: Review firewall and Network Security Group (NSG) rule requests; configure and manage Azure Firewall, Azure WAF, Application Gateways, and virtual network segmentation (VNet topologies).
SIEM, Monitoring & SOC Integration: Monitor security events using SIEM technologies (Microsoft Sentinel, Splunk, CNAPP); validate Splunk parsers and author Splunk Query Language (SPL) searches; partner with VDOT's SOC for threat hunting and incident containment.
Vulnerability & Workload Protection: Perform cloud vulnerability scanning and risk assessments using Defender for Cloud, Nessus, or Tenable; manage Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWPP), and CNAPP tools.
Identity & Access Governance: Enforce Least-Privilege access controls, Role-Based Access Control (RBAC), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), and Entra ID security policies.
Audits, Governance & Collaboration: Generate architecture diagrams, IP schemes, and evidence for compliance audits; explain complex risks to non-technical stakeholders; mentor junior engineering staff.
Required Qualifications & Experience
Enterprise Cloud Infrastructure: 8+ years of experience engineering and supporting large-scale enterprise cloud infrastructure.
Enterprise Cloud Security: 5+ years of dedicated experience securing cloud production environments and implementing security controls.
Azure Network & Security Stack: Hands-on experience configuring NSGs, Resource Manager/Management Groups, Azure Firewall, Azure WAF, Azure Monitor, Log Analytics, Application Gateways, and VNet segmentation.
SIEM, Logging & Analytics: Deep experience with Splunk (SPL, parser validation, indexers), Microsoft Sentinel, CNAPP, log management, and threat detection.
Incident Response & Threat Hunting: Experience leading cloud incident investigations, log analysis, Indicator of Compromise (IOC) analysis, and SOC coordination.
Security Frameworks: Proven experience implementing SEC530, Zero Trust architecture, CIS Benchmarks, NIST CSF, and NIST 800-53 controls in public sector or regulated environments.
Policy & Automation: Experience building Azure Policies for enterprise compliance and Azure Automation runbooks for workflow orchestration.
Vulnerability Management & CSPM: Experience with cloud risk prioritization, attack surface management, CSPM, CWPP, and scanning tools (Defender, Nessus, Tenable).
Identity Governance (IAM): Hands-on experience with RBAC, PAM, Least-Privilege policies, and MFA enforcement.
Required Certifications: Must hold Azure Security Engineer Associate (AZ-500), CompTIA Security+, and Certified Cloud Security Professional (CCSP) certifications (or equivalent recognized cloud security credentials).
Preferred Qualifications
Advanced Architecture Certifications: Designing Microsoft Azure Infrastructure (AZ-305) or CISSP.
Direct experience securing cloud environments within large state government agencies or highly regulated enterprise environments.
