Cloud Security Engineer: Azure, Kubernetes & CSPM Specialist

TherapyNotes, LLC; Philadelphia, Northern (Philadelphia County, KY); Hybrid; USD 110,000 - 150,000; Full time

Benefits offered by this job

Competitive salary

Health, dental, vision, life, and disb

Retirement plan

Profit sharing

Onboarding program

Mentorship program

Open, collaborative work environment

Job summary

TherapyNotes, LLC is seeking an experienced Cloud Security Engineer to safeguard our cloud infrastructure, containerized workloads, and IaC pipelines in a HIPAA-regulated environment. You will join a small, collaborative security team to drive CSPM excellence and incident response.

The role emphasizes securing Azure-based workloads, AKS clusters, and identity management with Entra ID, while implementing Zero Trust and SASE controls across the organization.

Qualifications

• Bachelor's degree in information security, computer science, or related field preferred; equivalent experience considered.
• 5+ years of experience in cloud security engineering or related role.
• Deep, hands-on experience securing cloud infrastructure and cloud-based applications (Azure preferred, AWS a plus).
• Hands-on network security experience and a strong understanding of network architecture, connectivity, segmentation, and firewall controls.
• Experience securing containerized workloads and Kubernetes environments (e.g., AKS) — network policy, workload identity, runtime protection.
• Experience with cloud security posture management (CSPM) and remediating misconfigurations across cloud environments.
• Experience securing IaC orchestration platforms — access control, secrets management, and deployment approval workflows (Terraform, OpenTofu).
• Experience with Microsoft Entra ID, including Conditional Access, Entitlement Management, and just-in-time (JIT) privileged access models.
• Experience with Zero Trust / SASE tooling (e.g., Cloudflare Zero Trust, WAF, Gateway, or equivalent).
• Knowledge of security frameworks (NIST, ISO 27001, CIS) and compliance frameworks (HITRUST, PCI DSS).
• Proven ability to conduct security assessments, vulnerability management, and incident response.
• Strong understanding of OS platforms (Windows, Linux) and endpoint security.

Responsibilities

• Manage and secure cloud infrastructure and cloud-based applications, with a focus on Azure.
• Secure containerized workloads and Kubernetes environments (e.g., AKS) — network policy, workload identity, runtime protection, and container image scanning.
• Own and mature cloud security posture management (CSPM) — continuously identify and remediate misconfigurations across cloud environments.
• Secure infrastructure-as-code orchestration platforms — access control, secrets management, and deployment approval workflows for Terraform/OpenTofu pipelines.
• Manage and secure identities in Microsoft Entra ID through Conditional Access, Entitlement Management, and just-in-time (JIT) privileged access models.
• Review network diagrams and proposed connectivity changes, provide security input on segmentation and sensitive data flows, and work with IT and SRE teams to address identified concerns.
• Administer Zero Trust network access and edge security tooling to secure access to corporate and cloud resources.
• Hands-on management of broader security solutions across the organization: SIEM, DLP, E/XDR, vulnerability management.
• Monitor security alerts, respond to and elevate incidents, and participate in the incident response on-call rotation.
• Conduct threat analysis, vulnerability assessments, and risk evaluations; document findings, manage mitigation, and report status to leadership.
• Develop queries, scripts, integrations, and automated workflows that improve cloud security operations.
• Collaborate with development teams to ensure security is continuously integrated into the SDLC and CI/CD pipeline.
• Conduct periodic cloud configuration and access reviews to ensure compliance with security standards.
• Participate in audits and assessments, supporting governance, risk management, and compliance (GRC) efforts.

Skills

Cloud security

Kubernetes security

Zero Trust

CSPM

IAM / Entra ID

Incident response

Education

Bachelor's degree in information security / CS

Tools

Azure

AKS

Terraform/OpenTofu

Microsoft Entra ID

Job description

TherapyNotes, LLC is seeking an experienced Cloud Security Engineer to safeguard our cloud infrastructure, containerized workloads, and IaC pipelines in a HIPAA-regulated environment. You will join a small, collaborative security team to drive CSPM excellence and incident response.

The role emphasizes securing Azure-based workloads, AKS clusters, and identity management with Entra ID, while implementing Zero Trust and SASE controls across the organization.