Remote Azure Cloud Security Engineer – Defender, IAM & Automation

CMG Financial; United States; On-site; USD 110,000 - 150,000; Full time

Job summary

CMG Financial is hiring a Security Engineer for our Azure‑primary cloud and the hybrid environment that supports one of the nation’s largest privately‑held mortgage lenders. You will harden cloud posture, tighten identity and access, and build detection and automation to keep our environment defensible.

Responsibilities include operating Defender for Cloud, Entra ID RBAC and PIM, Terraform/GitHub Actions security, and crafting detections with Microsoft Sentinel.

Qualifications

• 3+ years in cloud security or cloud engineering with hands-on Azure security.
• Bachelor’s degree in CS, Cybersecurity, Information Systems, or related field, or equivalent experience.

Responsibilities

• Operate Defender for Cloud across Azure subscriptions and remediate misconfigurations.
• Enforce Azure Policy and CIS/NIST benchmarking in cloud posture.
• Apply least-privilege with Entra ID, RBAC, PIM, and Conditional Access; run access reviews.
• Classify and protect data using Purview and DSPM.
• Embed security into Terraform and GitHub Actions pipelines; perform IaC scans.
• Support threat modeling and secure design reviews for workloads.
• Engineer Sentinel data ingestion and build detections.
• Integrate Defender for Cloud signals into Sentinel for detection and response.
• Support cloud threat hunting, incident response, and automation of remediation.
• Map cloud controls to frameworks; produce evidence for audits.

Skills

Azure security

Defender for Cloud

Entra ID

CSPM/CNAPP

Terraform

GitHub Actions

Python

PowerShell

KQL

Microsoft Sentinel

AKS

Azure Key Vault

Education

Bachelor’s degree in CS or related field

Tools

GHAS

AKS

Azure Key Vault

Log Analytics

Job description

CMG Financial is hiring a Security Engineer for our Azure‑primary cloud and the hybrid environment that supports one of the nation’s largest privately‑held mortgage lenders. You will harden cloud posture, tighten identity and access, and build detection and automation to keep our environment defensible.

Responsibilities include operating Defender for Cloud, Entra ID RBAC and PIM, Terraform/GitHub Actions security, and crafting detections with Microsoft Sentinel.