Sr. Cloud Engineer

We are seeking a Senior Cloud Security Engineer to serve as a Subject Matter Expert (SME) supporting the enterprise Azure cloud migration in Mechanicsville, VA. This hybrid role provides senior-level technical leadership across cloud security architecture, identity and access management (IAM/RBAC/PAM), network security (Azure Firewall, WAF, NSGs, App Gateways), vulnerability management, and incident response. The engineer will align cloud environments with SEC530, Zero Trust, NIST 800-53, and CIS Benchmarks, build automated Azure Policy guardrails, create Azure Automation runbooks, and integrate security telemetry with Microsoft Sentinel and Splunk SIEM platforms.

Location: 9120 Lockwood Boulevard, Mechanicsville, VA 23116

Work Arrangement: Hybrid

Role Type: Contract (11/09/2026 – 06/30/2027)

Submission Deadline: Friday, October 23, 2026

Interview Process: Phone or In-Person Interview

Shift: EST Business Hours

Work Authorization Note: Candidates must physically reside within the United States (Commonwealth of Virginia security policy prohibiting offshore contractors).

Key Responsibilities

Cloud Architecture & Zero Trust Engineering: Architect, implement, and secure enterprise Azure cloud environments aligning with Zero Trust, SEC530, NIST CSF/800-53, and CIS Benchmarks.

Policy Guardrails & Automation: Develop custom Azure Policies to enforce compliance and standardization; build Azure Automation runbooks for automated incident response workflows and security guardrails within deployment pipelines.

Network & Boundary Security: Review firewall and Network Security Group (NSG) rule requests; configure and manage Azure Firewall, Azure WAF, Application Gateways, and virtual network segmentation (VNet topologies).

SIEM, Monitoring & SOC Integration: Monitor security events using SIEM technologies (Microsoft Sentinel, Splunk, CNAPP); validate Splunk parsers and author Splunk Query Language (SPL) searches; partner with VDOT's SOC for threat hunting and incident containment.

Vulnerability & Workload Protection: Perform cloud vulnerability scanning and risk assessments using Defender for Cloud, Nessus, or Tenable; manage Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWPP), and CNAPP tools.

Identity & Access Governance: Enforce Least-Privilege access controls, Role-Based Access Control (RBAC), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), and Entra ID security policies.

Audits, Governance & Collaboration: Generate architecture diagrams, IP schemes, and evidence for compliance audits; explain complex risks to non-technical stakeholders; mentor junior engineering staff.

Required Qualifications & Experience

Enterprise Cloud Infrastructure: 8+ years of experience engineering and supporting large-scale enterprise cloud infrastructure.

Enterprise Cloud Security: 5+ years of dedicated experience securing cloud production environments and implementing security controls.

Azure Network & Security Stack: Hands-on experience configuring NSGs, Resource Manager/Management Groups, Azure Firewall, Azure WAF, Azure Monitor, Log Analytics, Application Gateways, and VNet segmentation.

SIEM, Logging & Analytics: Deep experience with Splunk (SPL, parser validation, indexers), Microsoft Sentinel, CNAPP, log management, and threat detection.

Incident Response & Threat Hunting: Experience leading cloud incident investigations, log analysis, Indicator of Compromise (IOC) analysis, and SOC coordination.

Security Frameworks: Proven experience implementing SEC530, Zero Trust architecture, CIS Benchmarks, NIST CSF, and NIST 800-53 controls in public sector or regulated environments.

Policy & Automation: Experience building Azure Policies for enterprise compliance and Azure Automation runbooks for workflow orchestration.

Vulnerability Management & CSPM: Experience with cloud risk prioritization, attack surface management, CSPM, CWPP, and scanning tools (Defender, Nessus, Tenable).

Identity Governance (IAM): Hands-on experience with RBAC, PAM, Least-Privilege policies, and MFA enforcement.

Required Certifications: Must hold Azure Security Engineer Associate (AZ-500), CompTIA Security+, and Certified Cloud Security Professional (CCSP) certifications (or equivalent recognized cloud security credentials).

Preferred Qualifications

Advanced Architecture Certifications: Designing Microsoft Azure Infrastructure (AZ-305) or CISSP.

Direct experience securing cloud environments within large state government agencies or highly regulated enterprise environments.