Senior Cloud Governance Engineer

Kforce Inc; Charlotte (NC); On-site; USD 130,000 - 180,000; Full time

Job summary

Kforce Inc. is seeking a Security & Compliance Engineer to lead the end-to-end governance of cloud infrastructure. The role focuses on policy-as-code, Terraform validation, and automated audit evidence workflows to support SOC 2, ISO 27001, and NIST controls.

The candidate will operate CSPM tooling (Wiz), build governance dashboards in Azure Monitor, and collaborate with engineering to remediate findings and improve security posture across multiple subscriptions.

Qualifications

• GRC fundamentals including control mapping and remediation SLA tracking.
• Hands-on IT audits: scoping controls and collecting evidence.
• Knowledge of SOC 2, ISO 27001, NIST 800-53, CIS Benchmarks.
• Azure governance: policy inheritance, Defender for Cloud, Azure Monitor.
• Experience with Wiz or similar CSPM (Prisma Cloud/Orca).
• Read Terraform to understand remediation changes.
• AI-assisted workflows with command-line tools, Git, and QA of outputs.
• Backlog management across multiple teams with risk-based tradeoffs.

Responsibilities

• Own end-to-end compliance lifecycle for cloud infrastructure and ensure alignment with policies and standards.
• Translate requirements into Azure Policy definitions, Terraform validation rules, and guardrails.
• Design automated workflows for collecting and presenting audit evidence.
• Review Terraform patterns to ensure compliance and propose updates.
• Operate CSPM tooling (Wiz) to identify misconfigurations and drive remediation.
• Build and maintain compliance dashboards and workbooks with Azure Monitor.
• Design and build AI/LLM-driven governance tools for control mapping and evidence summarization.
• Maintain governance, risk, and compliance processes including risk register and remediation SLA monitoring.

Skills

GRC Fundamentals

IT Audit Experience

Communication & Influence

Prioritization & Program Management

AI-Assisted Workflows

Infrastructure as Code Literacy

Azure Governance

Policy-as-Code

Tools

Azure Policy

Terraform

Wiz

Microsoft Defender for Cloud

Azure Monitor

Job description

Responsibilities

• Compliance & Audit Readiness: Own the end-to-end compliance lifecycle for cloud infrastructure; Ensure environments are continuously aligned with organizational policies, regulatory frameworks (SOC 2, ISO 27001, NIST, CIS Benchmarks), and internal standards
• Policy-as-Code: Translate compliance requirements into enforceable Azure Policy definitions, Terraform validation rules, and automated guardrails that prevent non-compliant resources from being deployed
• Evidence Collection & Automation: Design and implement automated workflows for collecting, organizing, and presenting audit evidence; Reduce manual effort during audit cycles by building repeatable, auditable processes
• Terraform Pattern Governance: Review and provide guidance on infrastructure-as-code patterns to ensure they meet compliance, security, and operational standards; Propose required updates to existing Terraform modules when standards evolve
• Security Posture Management: Operate and optimize cloud security posture management (CSPM) tooling, primarily Wiz, to identify misconfigurations, prioritize risk, and drive remediation with engineering teams
• Monitoring & Reporting: Build and maintain compliance dashboards and workbooks using Azure Monitor and Azure Workbooks to provide real-time visibility into governance posture across subscriptions and environments
• AI-Powered Governance Tooling: Design and build AI/LLM-driven tools that accelerate governance workflows - such as automated control mapping, natural-language policy interpretation, intelligent evidence summarization, and anomaly detection across compliance data
• GRC Program Support: Maintain and operate governance, risk, and compliance (GRC) processes - including risk register management, control testing schedules, exception tracking, and remediation SLA monitoring

Requirements

• GRC Fundamentals: Strong grounding in governance, risk, and compliance, including control mapping, risk assessment, exception management, and remediation SLA tracking
• IT Audit Experience: Hands-on experience with internal and external IT audits: scoping controls, assembling evidence, answering auditor questions, and driving findings to closure
• Compliance Frameworks: Working knowledge of SOC 2, ISO 27001, NIST 800-53, and CIS Benchmarks, and the ability to read an internal standard and tell which technical requirement a control actually imposes
• Azure Governance: Solid understanding of Azure Policy, management groups and policy inheritance, Microsoft Defender for Cloud, and Azure Monitor
• CSPM Tools (Wiz): Experience using Wiz or a comparable CSPM platform (Prisma Cloud, Orca) to investigate findings, judge their accuracy, and know where the tool's coverage stops
• Infrastructure as Code Literacy: Able to read Terraform well enough to understand what a remediation changes and to write good acceptance criteria
• AI-Assisted Workflows: Comfortable using AI-assisted tools and command-line workflows, working in Git, and critically checking AI-generated output before relying on it
• Prioritization & Program Management: A record of running a backlog across several teams, making risk-based tradeoffs, and keeping work moving without direct authority
• Communication & Influence: Able to turn technical findings into clear remediation guidance for engineers, precise questions for compliance, and a concise posture summary for leadership and auditors

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.