Senior Azure Cloud Security Engineer

MasterApp Labs LLC; Mechanicsville (VA); Hybrid; USD 131,000 - 165,000; Part time

Benefits offered by this job

401(k) matching

Dental insurance

Health insurance

Vision insurance

Job summary

MasterApp Labs LLC in Mechanicsville, VA is seeking a Senior Azure Cloud Security Engineer to secure enterprise cloud environments and drive secure Azure architecture in a hybrid contract. You will lead security design, implement Azure controls, and promote secure deployment practices across multi-region environments.

The role demands hands-on IAM, SIEM, network security, and governance expertise, with the ability to translate technical risks to executives.

Qualifications

• Extensive enterprise cloud security experience and hands-on cloud engineering skills.
• Proven ability to design and implement Azure security controls and automation.
• Strong risk-based mindset with incident response and audits experience.
• Ability to communicate risks to executives and non-technical stakeholders.
• Experience documenting controls, topology diagrams, IP schemes and access controls.

Responsibilities

• Identify cloud security vulnerabilities, assess risk, prioritize remediation, and track actions.
• Lead complex cloud security initiatives and guide engineers; design secure Azure architecture.
• Enforce secure configurations in deployment pipelines and review NSG/Firewall changes.
• Explain complex security risks to non-technical stakeholders and support audits.
• Develop Azure policies and runbooks to support incident response workflows.
• Monitor security events with SIEM and coordinate with SOC for incident response.
• Lead investigation and containment of cloud security incidents.
• Collaborate with governance and application teams on security standards.

Skills

Enterprise cloud experience

Cloud security experience

Cybersecurity and networking

Cloud risk assessment

Security operations

SIEM familiarity

Azure security engineering

IAM / RBAC / PAM

Zero Trust

Regulatory environment experience

Documentation & diagrams

Tools

Azure Firewall

Azure WAF

Azure Monitor

Application Gateways

NSGs

Nessus / Tenable / Defender

SIEM (Splunk, Microsoft Sentinel)

CNAPP / CWPP

IAM tooling / PAM tooling

Job description

Benefits:

• 401(k) matching
• Dental insurance
• Health insurance
• Vision insurance

Title: Senior Azure Cloud Security Engineer

Location: Mechanicsville, VA, (Hybrid)

Position Type: Contract

Interview Mode: Either Phone or In Person

Key Responsibilities:

• Identify cloud security vulnerabilities, assess risk based on business impact, prioritize remediation, track remediation activities, and validate corrective actions
• Lead complex cloud security initiatives and provide technical directions to engineers. Also assist in the design of secure cloud architecture for complex enterprise environments
• Influence architecture and security decisions and prevent insecure configurations from reaching production and implement security gates within deployment pipelines.
• Explain complex security risks to non-technical stakeholders
• Assess cloud security risks and security gaps and recommend appropriate remediations. Create and maintain security documentation and evidence as well as support audits and assessments.
• Review proposed cloud solutions for security risk and define appropriate security and compensation controls.
• Will develop Azure policies to enforce standardization and compliance with enterprise requirements, as well as creating Azure Automation runbooks to support incident response workflows.
• Monitor security events using SIEM technologies and work with VDOT's SOC team to coordinate incident response activities.
• Identifies and diagnoses system problems and threats by using system logs, line monitors, SIEM, diagnostic software, and test equipment.
• Lead investigation and containment of cloud security incidents.
• Review firewall and NSG rule requests and ensure compliance with security standards.
• Must have the ability to provide documentation, architecture topology diagrams, IP schemes and access controls when required.
• Must have the ability to work independently on assigned projects.

Required/Desired Skills

• Enterprise Cloud Experience | Required | 8 |
• Enterprise Cloud Security Experience | Required | 5 |
• Candidate must be highly experienced as a cloud security professional with strong hands-on expertise in cloud infrastructure and cloud engineering | Required |
• Candidate must be highly experienced in cybersecurity, networking, identity, security operations, and have a deep cloud engineering competency | Required |
• Candidate must have in-depth experience moving between strategic architecture and hands-on engineering and identifying security risks | Required |
• Candidate must have in-depth experience designing practical solutions, implementing controls, and working with infrastructure teams | Required |
• Candidate must have in-depth experience working with application teams to continuously improve the organization's cloud security posture | Required |
• Candidate must have experience setting up Network Security Groups (NSGs), resource manager and management groups, monitor and log analytics, | Required |
• Candidate must have experience setting up Azure Firewall, Azure WAF, Azure Monitor, Application Gateways, virtual networks and network segmentation. | Required |
• Candidate must have experiences in: Incident response, Security investigations, Log analysis, Threat intelligence, Security monitoring, IOC analysis | Required |
• Candidate must have experiences coordinating during cyber incidents | Required |
• Candidate must have experience in vulnerability management, remediation tracking, vulnerability scanning tools (e.g. Nessus, Tenable, Defender) | Required |
• Candidate must have experience securing enterprise cloud environments and implementing security controls in production environments | Required |
• Candidate must have experience with the SIEM products (e.g. Splunk, Microsoft Sentinel, CNAPP), | Required |
• Candidate must have experience with log management, security analytics, SOC integration, Threat detection, and Threat hunting | Required |
• Candidate must also have hands on expertise validating indexer parsers, leveraging Splunk Query Language for monitoring and data analysis. | Required |
• Candidate must have experience collaborating with the security governance team and application leads to implement enterprise log management standards. | Required |
• Candidate must have experience with; SEC530, CIS Benchmarks, NIST CSF, NIST 800-53, Zero Trust principles | Required |
• Candidate must have experience in cloud vulnerability management, remediation tracking, and risk assessment and prioritization | Required |
• Candidate must have experience in cloud risk assessment and prioritization, attack surface management, and Cloud Security Posture Management (VSPM) | Required |
• Candidate must have experience in Cloud Workload Protection (CWPP) and Cloud-Native Application Protection Platform (CNAPP) | Required |
• Candidate must have experience developing Azure Policy to enforce standardization and compliance with enterprise requirements | Required
• Candidate must have experience creating Azure Automation runbooks to support incident response workflows. | Required |
• Candidate must have experience with Identity and access management (IAM), Role-based Access control (RBAC), and Privileged Access Management (PAM) | Required |
• Candidate must have experience with Least-privilege access and multi-factor authentication | Required |
• Candidate must have experience working in highly regulated environments with large government agencies or similar regulatory environments. | Required |
• Candidate must have ability to communicate technical issues to technical, non-techical, and executive audiences. | Required |
• Candidate must have ability mentor junior engineers. | Required |
• Required: Azure Security Engineer Associate, Security+, Certified Cloud Security Professional certifications | Required |
• Preferred: CCSP, Designing Microsoft Azure Infrastructure (AZ-305) | Desired |

Flexible work from home options available.