Cloud Security Engineer

CBTS; United States; Remote; USD 96,000 - 110,000; Full time

Job summary

CBTS is seeking a Cloud Security Engineer to bolster security across Azure and AWS in a fully remote 6-month contract. You will design guardrails, harden IAM and networks, enhance detection and incident response, and automate security into CI/CD pipelines. Healthcare/regulatory experience is a plus.

Requirements include hands-on cloud security in production, IaC proficiency, and certifications such as AWS Security Specialty or CISSP. Remote work, US-based, 6-month engagement.

Qualifications

• Hands-on experience securing both Azure and AWS in production environments.
• Strong experience in Cloud IAM and identity security.
• Demonstrated experience in cloud security architecture and guardrails.
• Experience with network and workload security in the cloud.
• Experience with detection, monitoring, and incident response in cloud environments.
• Proficiency in Infrastructure-as-Code and security automation (e.g., Terraform, Bicep, CloudFormation, Python, PowerShell).
• Ability to work independently in a fully remote, fast-moving contract role.
• Experience in healthcare, insurance, or other regulated industries (HIPAA, HITRUST, SOC 2).
• Relevant certifications such as AWS Certified Security – Specialty, Microsoft SC-100 or AZ-500, CISSP, or CCSP.
• Experience with CSPM and CNAPP tools and DevSecOps practices.

Responsibilities

• Design, implement, and enforce cloud security guardrails across Azure and AWS.
• Harden identity and network controls, enforce least privilege and MFA.
• Identify and remediate excessive permissions and orphaned identities.
• Define and implement security architecture patterns and guardrails (Azure Policy, AWS Config, Security Hub).
• Establish secure landing zones and baseline configurations aligned to CIS and NIST.
• Review cloud designs and provide security guidance to engineering teams.
• Secure cloud networks with NSGs, security groups, firewalls, private endpoints, and WAF.
• Harden workloads (VMs, containers, Kubernetes, serverless) and manage vulnerabilities.
• Apply encryption, key management, and secrets management best practices.
• Build and tune monitoring with Defender for Cloud, Sentinel, GuardDuty, CloudTrail.
• Support investigation and response for cloud security incidents and contribute to runbooks.
• Integrate cloud telemetry with SIEM and SOC workflows.
• Embed security into IaC and CI/CD pipelines; policy-as-code and automated scanning.
• Automate remediation and compliance checks with scripting.

Skills

Azure

AWS

Cloud IAM

Identity security

Cloud security architecture

Guardrails

Network security

Workload hardening

IaC

Security automation

Terraform

Bicep

CloudFormation

Python

PowerShell

CI/CD

DevSecOps

Audit & compliance

Education

AWS Certified Security – Specialty

Microsoft SC-100

AZ-500

CISSP

CCSP

Tools

Null

Job description

Azure & AWS Cloud Security Engineer - 100% Remote - 6 Month Contract W-2 Only Pay Rate: $70/hr-$80 Per hour W-2 Only - Corp-to-Corp (C2C) candidates will not be considered.

CBTS is seeking a Cloud Security Engineer to strengthen the security posture of its Microsoft Azure and Amazon Web Services (AWS) environments. In this 6-month contract role, you will design and enforce cloud security guardrails, harden identity and network controls, improve detection and incident response, and automate security through code. You'll work with cloud, infrastructure, and security teams in a regulated healthcare environment, where protecting sensitive member data is critical.

Responsibilities

Cloud IAM and Identity Security

• Design, implement, and review identity and access controls across Azure (Entra ID, RBAC, PIM) and AWS (IAM, SCPs, Identity Center).
• Enforce least privilege, role-based access, MFA, and conditional access.
• Identify and remediate excessive permissions, orphaned identities, and risky service principles and roles.

Cloud Security Architecture and Guardrails

• Define and implement security architecture patterns and preventive and detective guardrails (e.g., Azure Policy, AWS Config, Security Hub).
• Establish secure landing zones and baseline configurations aligned to industry benchmarks such as CIS and NIST.
• Review cloud designs and provide security guidance to engineering teams.

Network and Workload Security

• Secure cloud networks using segmentation, NSGs and security groups, firewalls, private endpoints, and WAF.
• Harden workloads including VMs, containers, Kubernetes, and serverless, and manage vulnerabilities and misconfigurations.
• Apply encryption, key management, and secrets management best practices.

Detection, Monitoring, and Incident Response

• Build and tune monitoring and alerting using tools such as Microsoft Defender for Cloud, Microsoft Sentinel, AWS GuardDuty, and CloudTrail.
• Support investigation and response for cloud security incidents and contribute to runbooks and post-incident reviews.
• Integrate cloud telemetry with SIEM and SOC workflows.

Infrastructure-as-Code (IaC) and Security Automation

• Embed security into IaC (Terraform, Bicep, ARM, CloudFormation) and CI/CD pipelines, including policy-as-code and automated scanning.
• Automate remediation and compliance checks using scripting (Python, PowerShell, Bash).
• Document controls and produce evidence to support audit and compliance activities.

Requirements

• Hands‑on experience securing both Azure and AWS in production environments.
• Strong experience in Cloud IAM and identity security.
• Demonstrated experience in cloud security architecture and guardrails.
• Experience with network and workload security in the cloud.
• Experience with detection, monitoring, and incident response in cloud environments.
• Proficiency in Infrastructure-as-Code and security automation (e.g., Terraform, Bicep, CloudFormation, Python, PowerShell).
• Ability to work independently in a fully remote, fast-moving contract role.
• Experience in healthcare, insurance, or other regulated industries (HIPAA, HITRUST, SOC 2).
• Relevant certifications such as AWS Certified Security – Specialty, Microsoft SC-100 or AZ-500, CISSP, or CCSP.
• Experience with CSPM and CNAPP tools and DevSecOps practices.

CBTS provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, disability, genetic information, marital status, amnesty, or status as a protected veteran in accordance with applicable federal, state and local laws.