Senior Cloud Security Engineer

Capgemini; New Jersey; On-site; USD 51,000 - 80,000; Full time

Job summary

Capgemini in Warren, NJ is seeking a Senior Cloud Security Engineer for a hands-on contract focused on hardening cloud security. You will own remediation across the environment, reduce recurring findings, and ensure controls are built in by design.

The role emphasizes root-cause analysis, policy-as-code, and secure baselines using Azure Policy, Terraform, and Defender for Cloud, with Azure Entra ID and modern authentication at the core.

Qualifications

• 9+ years in cloud security or security engineering with hands-on Azure experience.
• Strong Entra ID expertise: apps, permissions, consent, CA policies.
• Solid knowledge of modern auth: OIDC, OAuth2/PCKE, JWT, mTLS.
• Policy-as-code and automated guardrails with Terraform/Azure Policy.
• Experience with Defender for Cloud and CSPM practices.
• Proven root-causing and permanent remediation of findings; AI security awareness.

Responsibilities

• Own remediation lifecycle from triage to closure for security findings.
• Identify root causes and implement systemic fixes and guardrails.
• Track SLAs, report risk reduction and posture trends over time.
• Secure cloud and SaaS admin portals and manage privileged access.

Skills

Azure

Entra ID

OIDC

OAuth2 PKCE

JWT

mTLS

Defender for Cloud

Root-cause analysis

AI security

PowerShell

Tools

Terraform

Azure Policy

PowerShell

Python

SIEM/SOAR

Job description

Warren, NJ, United States (On-site)

Contract (4 months 4 days)

Published 4 days ago

Security Operations

root cause analysis

configuration management

scripting

We’re hiring a Senior Cloud Security Engineer to serve as the dedicated owner of cloud security remediation and hardening across our environment.

Our organization already has an established security team that identifies risks and issues recommendations. This role does not sit on that team. Instead, you are the engineer who turns those recommendations into durable, well-architected fixes—and, just as importantly, makes sure the same findings don’t come back.

This is a hands-on engineering role, not an advisory one. Success means a measurably more secure environment, a shrinking backlog of recurring findings, and security controls that are enforced by design rather than by manual effort or one-off patches.

What You’ll Do:

Remediation & recurrence prevention (the core of this role):

Own the full lifecycle of security findings and recommendations—whether they come from the security team, Microsoft Defender for Cloud, or other tooling—through triage, remediation, verification, and closure.

Root-cause recurring issues and implement systemic fixes (policy-as-code, automated guardrails, secure baselines) so the same findings don’t reappear quarter after quarter.

Track remediation SLAs and report on risk reduction and posture trends over time.

Identity & authentication:

Secure and govern modern authentication flows across the estate: OIDC, OAuth 2.0 with PKCE, JWT validation and handling, and mTLS.

Administer and harden Microsoft Entra ID (Azure Entra): app registrations and Enterprise Application permissions, consent governance, service principals and managed identities, credential and secret hygiene, and least-privilege scoping.

Design, implement, and continuously tune Conditional Access policies.

Cloud security engineering & governance:

Build and enforce guardrails using Azure Policy and Terraform; maintain secure-by-default infrastructure-as-code baselines and detect/remediate configuration drift.

Operate Microsoft Defender for Cloud—drive secure-score improvement, remediate recommendations, and manage cloud security posture (CSPM).

Contribute to security governance: standards, control definitions, exception handling, and audit evidence.

Admin portal & privileged access security:

Secure all cloud and SaaS administrative portals - Azure and other admin consoles (e.g., Microsoft 365 admin, identity providers, and any additional cloud platforms in use).

Strengthen privileged access: MFA enforcement, Privileged Identity Management (PIM) / just-in-time elevation, role minimization, and break-glass procedures.

AI security:

Apply security controls to AI workloads, services, and AI agents: agent and workload identities, tool and permission scoping, data-exposure and prompt-injection risk, and emerging AI security best practices.

What You Bring (Required):

9+ years in cloud security or security engineering, with deep, hands-on Azure experience.

Strong, hands-on Microsoft Entra ID expertise: app registrations, Enterprise Apps, permissions and consent, and Conditional Access.

Solid working knowledge of modern authentication: OIDC, OAuth 2.0 / PKCE, JWT, and mTLS.

Proficiency with Terraform and Azure Policy for policy-as-code and automated guardrails.

Experience with Microsoft Defender for Cloud and cloud security posture management.

A demonstrable track record of root-causing and permanently closing security findings—not just patching them.

Working understanding of AI, AI agents, and AI security considerations.

Nice to Have:

Experience with CI/CD pipeline security, secrets management, and SIEM/SOAR.

Scripting/automation (PowerShell, Python).

Hands-on experience securing LLM-based or agentic systems in production.

The pay range that the employer in good faith reasonably expects to pay for this position is $36.98/hour - $57.79/hour. Our benefits include medical, dental, vision and retirement benefits. Applications will be accepted on an ongoing basis.

Tundra Technical Solutions is among North America’s leading providers of Staffing and Consulting Services. Our success and our clients’ success are built on a foundation of service excellence. We are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic. Qualified applicants with arrest or conviction records will be considered for employment in accordance with applicable law, including the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act. Unincorporated LA County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: client provided property, including hardware (both of which may include data) entrusted to you from theft, loss or damage; return all portable client computer hardware in your possession (including the data contained therein) upon completion of the assignment, and; maintain the confidentiality of client proprietary, confidential, or non-public information. In addition, job duties require access to secure and protected client information technology systems and related data security obligations.