Cloud Security Engineer — AI & Government Cloud

Amentum; Helena (MT); On-site; USD 130,000 - 140,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Paid time off

Holidays

401(k) matching

Educational reimbursement

Parental leave

Employee stock purchase plan

Tax-saving options

Disability insurance

Life insurance

Pet insurance

Job summary

Amentum seeks a Cloud Security Engineer to implement and maintain security controls across Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid environments. You will design guardrails, test policies, and automate controls, while coordinating with platform owners and risk teams.

The role covers AI security, government-cloud compliance, and collaboration with SOC and risk-management functions to ensure audit-ready records and secure AI deployments.

Qualifications

• U.S. citizenship is required for this position.
• Bachelor's degree in cybersecurity, information technology, computer science, engineering, or a related field, or an equivalent combination of education and relevant experience.
• Five years of related experience, including three or more years in cloud, security, systems, or infrastructure engineering.
• Hands-on experience with Microsoft cloud or AWS security capabilities and the ability to support Microsoft 365, Azure, AWS, and hybrid services as needed.
• Experience implementing or maintaining technical controls through cloud policy, scripting, automation, or infrastructure as code.

Responsibilities

• Implement and maintain security controls across Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid services, including cloud guardrails, secure landing zones, workload protections, and virtual desktop environments.
• Configure and test security policies, infrastructure-as-code controls, deployment automation, and supporting integrations in coordination with cloud platform and application owners.
• Review technical findings, troubleshoot control failures, and recommend practical configuration changes that reduce risk without unnecessarily disrupting services.
• Administer assigned cloud security posture management and workload protection capabilities, including environment onboarding, policy configuration, security recommendations, coverage monitoring, and alert integrations.
• Maintain platform health and configuration, tune controls, document exceptions, and identify gaps in cloud coverage.
• Integrate cloud security telemetry with Security Operations and the managed security service provider. Support escalated investigations when cloud expertise is needed.
• Coordinate exposure prioritization and tracking with Vulnerability Management and work with cloud platform owners on remediation. The role does not own the underlying cloud services or their remediation queues.
• Implement and validate technical controls that support CMMC and applicable NIST requirements, including NIST SP 800-171 and NIST SP 800-172.
• Support Microsoft 365 GCC High and CUI workloads with an understanding of government-cloud service limitations, tenant and security boundaries, data handling requirements, and controlled connectivity with commercial environments.
• Translate applicable requirements from DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, and other relevant frameworks into practical cloud configurations in coordination with Risk and Compliance.
• Perform technical risk assessments and control testing; maintain implementation records, evidence, exceptions, and remediation status for assessments and audits.
• Implement and operate security controls for approved AI and machine-learning services, enterprise copilots, generative AI applications, retrieval-augmented generation, agents, and tool integrations.
• Configure identity and access controls, data-source permissions, secrets handling, execution boundaries, sandboxing, tool restrictions, human approval controls, network egress, logging, and other safeguards defined by Architecture.
• Test controls against risks such as prompt injection, indirect prompt injection, sensitive-data exposure, unsafe tool execution, over-privileged agents, unapproved model or service use, and manipulation of grounding content.
• Evaluate AI service configurations and new platform features for security, privacy, data residency, government-cloud availability, and CUI handling before implementation.
• Automate repeatable AI security configurations and validation checks through policy, scripting, infrastructure as code, and deployment pipelines where practical.
• Integrate relevant AI activity and security telemetry with enterprise monitoring and support investigations requiring AI expertise.
• Work with Identity, Network Security, Data Security, Detection and Incident Response, IT, connected program sites, and application teams to implement controls within their areas of responsibility.
• Maintain configuration standards, implementation guides, diagrams, operating procedures, and support documentation for assigned cloud security capabilities.
• Translate applicable security and regulatory requirements into technical configurations and provide evidence or technical input for assessments and audits when requested.
• Stay current on cloud and AI security threats and recommend improvements based on observed risk, platform changes, and operational experience.
• Participate in 2nd-level Security Operations Center (SOC) activities, e.g. respond to critical security incidents escalated by a MSSP. Provide off-hours support on an infrequent, but as needed basis.

Skills

Cloud security concepts

AI security risks

Troubleshooting

Collaboration with teams

Risk assessments

Education

Bachelor's degree in cybersecurity

Job description

Amentum seeks a Cloud Security Engineer to implement and maintain security controls across Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid environments. You will design guardrails, test policies, and automate controls, while coordinating with platform owners and risk teams.

The role covers AI security, government-cloud compliance, and collaboration with SOC and risk-management functions to ensure audit-ready records and secure AI deployments.