Cloud AI Security Engineer

Thales Defense & Security, Inc.; Clarksburg (MA); Hybrid; USD 89,000 - 120,000; Full time

Benefits offered by this job

Competitive Salary

Yearly Incentive Compensation Plan

Medical insurance for self and family

401(k) with company contribution and 追

Tuition Reimbursement

Paid wellness, vacation and holiday

Parental leave

9/80 Work Schedule

Hybrid working environment

Job summary

Thales Defense & Security, Inc. is seeking a hands-on Cloud Security Engineer to build and operate core cloud security controls for DoD and government workloads from our Clarksburg, MD office.

You will partner across teams to enhance identity, network segmentation, data protection, logging, and compliance. The role requires Azure/AWS security experience, CSPM/CWPP tooling, and ability to deliver audit-ready evidence for FedRAMP/NIST controls.

Qualifications

• U.S. Citizenship required and able to obtain government clearance.
• Bachelor’s degree in a technical field or equivalent experience.
• 3–6 years in cybersecurity with 2+ years in Azure/AWS security in enterprise/government environments.
• Hands-on with IAM, network security, encryption, logging/monitoring, CSPM/CWPP tools.
• Experience with infrastructure-as-code and policy-as-code; scripting for automation (PowerShell/Python/Bash).
• Knowledge of FedRAMP, CMMC, NIST SP 800-53, DoD Cloud SRG.

Responsibilities

• Establish baseline cloud security controls (IAM/Entra ID, network segmentation, encryption, logging) with dashboards/runbooks.
• Deploy/tune CSPM/CWPP tooling; reduce misconfigurations and critical findings.
• Deliver audit-ready evidence for FedRAMP/CMMC/NIST control families in scope.
• Stand up detections for cloud and AI-specific threats in SIEM (Microsoft Sentinel or Splunk); document playbooks.
• Design and operate security controls across Azure/AWS: IAM/Entra ID, VNet/VPC, NSGs, WAF, PrivateLink.
• Implement Zero Trust/least privilege; establish guardrails (Azure Policy, AWS SCPs, OPA/Gatekeeper).
• Integrate CSPM/CWPP tooling with SIEM; maintain runbooks/diagrams/SOPs.
• Protect AI/ML pipelines: secure data, model repos, inference endpoints; enforce access controls and logging.
• Conduct threat modeling and risk assessments; deliver remediation plans and follow-up with partners.
• Support FedRAMP, CMMC, NIST 800-53 compliance; produce artifacts for audits.

Skills

IAM & Entra ID

Network security

Encryption

Logging & monitoring

CSPM/CWPP tools

Infrastructure as code

Scripting (PowerShell/Python/Bash)

Compliance frameworks

Cloud security

Communication & collaboration

Education

Bachelor’s degree in a technical field

Tools

Microsoft Sentinel

Splunk

PowerShell

Python

Entra ID

AWS

Azure

Job description

Thales Defense & Security, Inc. (TDSI) Headquartered in Clarksburg, MD, is a U.S. company that has been serving domestic and international defense Air, Land and Sea domains for 60+ years. With over 1,000 employees, TDSI and its four subsidiaries (Advanced Acoustic Concepts, Digital Receiver Technology, Tampa Microwave, and Trusted Cyber Technologies), supports U.S. Joint Services, special operations forces and multi-national partners with a variety of communication, visualization, signal intelligence/electronic warfare, and sensor/sonar capabilities. TDSI’s key technologies include tactical handheld radios, expeditionary satellite terminals, helmet-mounted displays, optics and target recognition capability, advanced radars, undersea sensing and missile systems. Lives depend on what we do!

Top Benefits (Subject to terms of applicable policies/plans)

• - Competitive Salary
• - Yearly Incentive Compensation Plan
• - Medical insurance for self and eligible family members
• - Generous 401(k) program- up to 7% company contribution and 100% immediate vesting
• - Tuition Reimbursement
• - Paid wellness, vacation, and holiday leave
• - Paid maternity, paternity, and parental leave
• - 9/80 Work Schedule (every other Friday off)
• - Hybrid working environment

We are seeking a hands-on Cloud Security Engineer with practical experience in Azure and/or AWS who can help build and operate core cloud security controls while integrating security into AI/ML workflows. This foundational role will partner across teams to deliver measurable improvements in identity, network segmentation, data protection, logging/monitoring, and compliance for DoD and government workloads. This role is located in our Clarksburg, MD office and will report to the Director of Cybersecurity.

Responsibilities

• - Establish baseline cloud security controls (IAM/Entra ID, network segmentation, encryption, logging) with dashboards and runbooks.
• - Deploy or tune CSPM/CWPP tooling; reduce misconfigurations and critical findings by agreed targets.
• - Deliver audit-ready evidence for FedRAMP/CMMC/NIST SP 800-53 control families in scope.
• - Stand up detections for cloud and AI-specific threats in Microsoft Sentinel or equivalent SIEM; document response playbooks.
• - Design and operate security controls across Azure/AWS: IAM/Entra ID, VNet/VPC controls, NSGs/Security Groups, WAF, private endpoints/PrivateLink.
• - Implement Zero Trust/least privilege patterns; establish guardrails. (Azure Policy, AWS SCPs, OPA/Gatekeeper).
• - Deploy and maintain CSPM/CWPP tooling and integrate with SIEM (Microsoft Sentinel / Splunk).
• - Protect AI/ML pipelines pragmatically: secure training data, model repos, and inference endpoints; apply access controls and logging.
• - Conduct threat modeling and risk assessments; document findings with prioritized remediation plans and partner follow-through.
• - Support compliance for FedRAMP, CMMC, NIST SP 800-53; produce artifacts and evidence for audits.
• - Maintain runbooks, diagrams, and SOPs; drive continuous improvement through metrics.

Qualifications

The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• - U.S. Citizenship required. - Applicants selected may be subject to a government security investigation and must meet eligibility requirements for access to classified information.
• - Bachelor’s degree in a technical field or equivalent experience.
• - 3 - 6 years in cybersecurity with 2+ years focused on Azure and/or AWS security in enterprise or government environments.
• - Hands-on experience with IAM, network security, encryption, logging/monitoring, and CSPM/CWPP tools.
• - Experience with infrastructure-as-code and policy-as-code; scripting for automation (PowerShell/Python/Bash).
• - Working knowledge of compliance frameworks (FedRAMP, CMMC, NIST SP 800-53, DoD Cloud SRG).
• - Strong communication and collaboration skills; ability to document and drive cross-team remediation.
• - Ability to participate in a rotating on‑call schedule to support continuous service and respond to priority issues as needed

Preferred

• - Certifications: CISSP, CCSP, CISM, Azure Security Engineer, Security+.
• - Experience integrating security into MLOps, LLMs, or generative AI applications.
• - Container/Kubernetes security experience; service mesh and runtime protections.
• - Experience with Azure Stack Edge family of devices.
• - Experience with DoD networks, especially classified and operational networks.
• - Understanding of enterprise networking concepts, especially Virtual Private Networks (VPNs), tunneling, QoS, and cloud connectivity solutions (e.g. Azure Express Route).

The annualized pay range for this role is $88,920.00 - $120,000.00 USD along with a target incentive compensation plan (ICP) of 5%. The pay range provided is a good faith estimate representative of the experience level for the role described above. TDSI considers several factors when extending an offer, including but not limited to, the role, function and associated responsibilities, a candidate’s work experience, location, education/training, and key skills.

Thales Defense & Security, Inc. is committed to non-discrimination as applicable under federal, state and local laws. We are an E-Verify Employer.