Senior Azure Cloud Security Engineer

Cloud Analytics Technologies, LLC; Chicago (IL); Presencial; USD 150.000 - 190.000; Tempo integral

Resumo da vaga

Cloud Analytics Technologies, LLC is seeking a Senior Azure Cloud Security Engineer to own remediation and hardening across our Azure environments. You will turn security findings into durable fixes, reduce recurring issues, and design security into infrastructure by design.

The role is hands-on, focusing on implementation, automation, and governance to shrink the backlog of findings and raise overall security posture. A strong Azure background and Entra ID expertise are required.

Qualificações

• 5+ years in Cloud Security or security engineering, with deep Azure experience.
• Strong hands-on Microsoft Entra ID expertise: app registrations, permissions, and CA.
• Solid knowledge of modern authentication: OIDC, OAuth 2.0 / PKCE, JWT, and mTLS.
• Proficiency with Terraform and Azure Policy for policy-as-code and automated guardrails.
• Experience with Microsoft Defender for Cloud and cloud security posture management.
• A demonstrable track record of root-causing and permanently closing security findings.

Responsabilidades

• Own the full lifecycle of security findings and recommendations, triage/remediation/verification/closure.
• Root-cause recurring issues and implement systemic fixes (policy-as-code, automated guardrails, secure baselines).
• Track remediation SLAs and report on risk reduction and posture trends over time.
• Secure and govern modern authentication flows: OIDC, OAuth 2.0 with PKCE, JWT, and mTLS.
• Administer and harden Microsoft Entra ID: app registrations, permissions, consent governance, service principals, secret hygiene, least-privilege.
• Design, implement and tune Conditional Access policies.
• Build guardrails using Azure Policy and Terraform; maintain secure-by-default IaC baselines and detect drift.
• Operate Defender for Cloud, drive secure-score improvement, remediate recommendations, manage CSPM.
• Contribute to security governance: standards, control definitions, exception handling, and audit evidence.
• Secure cloud/SaaS admin portals; strengthen privileged access with MFA, PIM, just-in-time elevation.

Conhecimentos

Azure security

Microsoft Entra ID

OIDC / OAuth 2.0 / PKCE

JWT / mTLS

Terraform

Azure Policy

Defender for Cloud

Root-cause analysis

AI security

Privileged Access Management (PIM)

Ferramentas

Terraform

Azure Policy

Defender for Cloud

Descrição da vaga

US Citizen, Green Card, H-1B, OPT-EAD, CPT, Other

We're hiring a Senior Azure Cloud Security Engineer to serve as the dedicated owner of cloud security remediation and hardening across our environment.

Our organization already has an established security team that identifies risks and issues recommendations. This role does not sit on that team. Instead, you are the engineer who turns those recommendations into durable, well-architected fixes and, just as importantly, makes sure the same findings don't come back.

This is a hands-on engineering role, not an advisory one. Success means a measurably more secure environment, a shrinking backlog of recurring findings, and security controls that are enforced by design rather than by manual effort or one-off patches.

What You'll Do

Remediation & Recurrence Prevention (the core of this role)

• Own the full lifecycle of security findings and recommendations, whether they come from the security team, Microsoft Defender for Cloud, or other tooling, through triage, remediation, verification, and closure.
• Root-cause recurring issues and implement systemic fixes (policy-as-code, automated guardrails, secure baselines) so the same findings don't reappear quarter after quarter.
• Track remediation SLAs and report on risk reduction and posture trends over time.

Identity & Authentication

• Secure and govern modern authentication flows across the estate: OIDC, OAuth 2.0 with PKCE, JWT validation and handling, and mTLS.
• Administer and harden Microsoft Entra ID (Azure Entra): app registrations and Enterprise Application permissions, consent governance, service principals and managed identities, credential and secret hygiene, and least-privilege scoping.
• Design, implement, and continuously tune Conditional Access policies.

Cloud Security Engineering & Governance

• Build and enforce guardrails using Azure Policy and Terraform; maintain secure-by-default infrastructure-as-code baselines and detect/remediate configuration drift.
• Operate Microsoft Defender for Cloud, drive secure-score improvement, remediate recommendations, and manage cloud security posture (CSPM).
• Contribute to security governance: standards, control definitions, exception handling, and audit evidence.

Admin Portal & Privileged Access Security

• Secure all cloud and SaaS administrative portals, including Azure and other admin consoles (e.g., Microsoft 365 admin, identity providers, and any additional cloud platforms in use).
• Strengthen privileged access through MFA enforcement, Privileged Identity Management (PIM) / just-in-time elevation, role minimization, and break-glass procedures.

AI Security

• Apply security controls to AI workloads, services, and AI agents, including agent and workload identities, tool and permission scoping, data-exposure and prompt-injection risk, and emerging AI security best practices.

What You Bring (Required):

• 5+ years in Cloud Security or Security engineering, with deep, hands-on Azure experience.
• Strong, hands-on Microsoft Entra ID expertise: app registrations, Enterprise Apps, permissions and consent, and Conditional Access.
• Solid working knowledge of modern authentication: OIDC, OAuth 2.0 / PKCE, JWT, and mTLS.
• Proficiency with Terraform and Azure Policy for policy-as-code and automated guardrails.
• Experience with Microsoft Defender for Cloud and cloud security posture management.
• A demonstrable track record of root-causing and permanently closing security findings, not just patching them.
• Working understanding of AI, AI agents, and AI security considerations.

Nice to Have:

• Experience with CI/CD pipeline security, secrets management, and SIEM/SOAR.
• Scripting/automation (PowerShell, Python).
• Hands-on experience securing LLM-based or agentic systems in production.

We are an equal opportunity employer. All aspects of employment including the decision to hire, promote, discipline, or discharge, will be based on merit, competence, performance, and business needs. We do not discriminate on the basis of race, color, religion, marital status, age, national origin, ancestry, physical or mental disability, medical condition, pregnancy, genetic information, gender, sexual orientation, gender identity or expression, national origin, citizenship/ immigration status, veteran status, or any other status protected under federal, state, or local law.