Senior Cloud Security Engineer

DataStaff, Inc.; Richmond (VA); Hybrid; USD 140,000 - 180,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

Paid vacation, sick, holiday leave

401k program after 6 months

Job summary

DataStaff, Inc. is seeking a Senior Cloud Security Engineer for a long-term contract in Richmond, VA.

This hybrid role requires leading cloud security initiatives, securing Azure environments, and collaborating across security operations, IT leadership, and engineering teams. The ideal candidate has extensive enterprise cloud security experience, hands-on expertise in Azure, IAM/RBAC, and SIEM tools, and can communicate complex risks to technical and non-technical audiences.

Qualifications

• 5+ years enterprise cloud security experience
• Hands-on expertise in cloud infrastructure and cloud engineering
• Cybersecurity, networking, identity, and security operations experience
• Experience balancing strategic architecture with hands-on engineering and risk identification
• Experience designing practical cloud security solutions and controls with infrastructure teams
• Experience enabling secure dev/ops and coupling security into pipelines
• Experience with NSGs, Azure Firewall, Azure Monitor, WAF, CVPs and CSPM/CWPP/NAC
• Experience with SIEM products (e.g., Splunk, Microsoft Sentinel) and log analytics
• Experience with IAM, RBAC, PAM, and least-privilege access
• Experience in regulated environments and strong communication to technical and executive audiences
• Certifications: Azure Security Engineer Associate, Security+, and Certified Cloud Security Professional

Responsibilities

• Identify cloud security vulnerabilities and prioritize remediation.
• Lead complex cloud security initiatives and guide engineers.
• Influence secure architecture decisions and enforce secure deployment gates.
• Explain security risks to non-technical stakeholders.
• Assess risks and gaps; define remediations.
• Create security documentation and support audits.
• Review cloud solutions for security risk and controls.
• Develop Azure policies and automation for incident response.
• Monitor security events and coordinate incident response.
• Maintain topology diagrams, IP schemes, and access controls.
• Mentor junior engineers and collaborate with governance teams.

Skills

Cloud security

Azure security

Security operations

IAM / RBAC

Threat intelligence

Incident response

SIEM

Splunk

Microsoft Sentinel

CNAPP / CWPP

Zero Trust

NIST CSF

NIST 800-53

SEC530

PAM

Tools

Azure NSG

Azure Firewall

Azure Monitor

Azure WAF

Application Gateways

Defender

Nessus

Tenable

Job description

DataStaff, Inc. is seeking a Senior Cloud Security Engineer for a long-term contract opportunity with one of our direct clients in Richmond, VA

*This position is hybrid

Job Description:

Our client is seeking an experienced Senior Cloud Security Engineer (Sr CSE) to implement and support the agency’s cloud and computing infrastructure. The Senior Cloud Security Engineer will serve as a subject matter expert supporting the enterprise Azure migration, responsible for architecting, implementing, and securing cloud environments in alignment with SEC530 principles, Zero Trust, and enterprise compliance frameworks.

The Senior Cloud Security Engineer will be responsible for assisting in the design, implementation, securing, monitoring, and continuous improvement of the cloud infrastructure and services across the enterprise. The position provides senior-level technical leadership for cloud security architecture, identity and access management, network security, security monitoring, vulnerability management, incident response, and cloud governance.

The Senior Cloud Security Engineer works closely with Cloud Engineering, Network Engineering, Security Operations, Enterprise Architecture, Infrastructure, Application Development, DevOps, Risk Management, and IT leadership to ensure cloud environments are secure, resilient, compliant, and aligned with enterprise security standards.

Responsibilities:

• Identify cloud security vulnerabilities, assess risk based on business impact, prioritize remediation, track remediation activities, and validate corrective actions
• Lead complex cloud security initiatives and provide technical direction to engineers. Also assist in the design of secure cloud architecture for complex enterprise environments
• Influence architecture and security decisions and prevent insecure configurations from reaching production and implement security gates within deployment pipelines.
• Explain complex security risks to non-technical stakeholders
• Assess cloud security risks and security gaps and recommend appropriate remediations.
• Create and maintain security documentation and evidence as well as support audits and assessments.
• Review proposed cloud solutions for security risk and define appropriate security and compensation controls.
• Develop Azure policies to enforce standardization and compliance with enterprise requirements, as well as create Azure Automation runbooks to support incident response workflows.
• Monitor security events using SIEM technologies and work with the team to coordinate incident response activities.
• Identify and diagnoses system problems and threats by using system logs, line monitors, SIEM, diagnostic software, and test equipment.
• Leads investigation and containment of cloud security incidents.
• Review firewall and NSG rule requests and ensure compliance with security standards.
• Must have the ability to provide documentation, architecture topology diagrams, IP schemes, and access controls when required.
• Must have the ability to work independently on assigned projects.

Required Skills:

• 5 Years - Enterprise Cloud Security Experience
• Candidate must be highly experienced as a cloud security professional with strong hands-on expertise in cloud infrastructure and cloud engineering
• Candidate must be highly experienced in cybersecurity, networking, identity, security operations, and have a deep cloud engineering competency
• Candidate must have in-depth experience moving between strategic architecture and hands-on engineering and identifying security risks
• Candidate must have in-depth experience designing practical solutions, implementing controls, and working with infrastructure teams
• Candidate must have in-depth experience working with application teams to continuously improve the organization's cloud security posture
• Candidate must have experience setting up Network Security Groups (NSGs), resource manager and management groups, monitor and log analytics,
• Candidate must have experience setting up Azure Firewall, Azure WAF, Azure Monitor, Application Gateways, virtual networks and network segmentation.
• Candidate must have experience in: Incident response, Security investigations, Log analysis, Threat intelligence, Security monitoring, IOC analysis
• Candidate must have experience coordinating during cyber incidents
• Candidate must have experience in vulnerability management, remediation tracking, vulnerability scanning tools (e.g. Nessus, Tenable, Defender)
• Candidate must have experience securing enterprise cloud environments and implementing security controls in production environments
• Candidate must have experience with SIEM products (e.g. Splunk, Microsoft Sentinel, CNAPP)
• Candidate must have experience with log management, security analytics, SOC integration, Threat detection, and Threat hunting
• Candidate must also have hands‑on expertise validating indexer parsers, leveraging Splunk Query Language for monitoring and data analysis.
• Candidate must have experience collaborating with the security governance team and application leads to implement enterprise log management standards.
• Candidate must have experience with: SEC530, CIS Benchmarks, NIST CSF, NIST 800‑53, Zero Trust principles
• Candidate must have experience in cloud vulnerability management, remediation tracking, and risk assessment and prioritization
• Candidate must have experience in cloud risk assessment and prioritization, attack surface management, and Cloud Security Posture Management (CSPM)
• Candidate must have experience in Cloud Workload Protection (CWPP) and Cloud-Native Application Protection Platform (CNAPP)
• Candidate must have experience developing Azure Policy to enforce standardization and compliance with enterprise requirements
• Candidate must have experience creating Azure Automation runbooks to support incident response workflows.
• Candidate must have experience with Identity and Access Management (IAM), Role-Based Access control (RBAC), and Privileged Access Management (PAM)
• Candidate must have experience with Least-privilege access and multi-factor authentication
• Candidate must have experience working in highly regulated environments with large government agencies or similar regulatory environments.
• Candidate must have the ability to communicate technical issues to technical, non-technical, and executive audiences.
• Candidate must have the ability to mentor junior engineers.
• Required: Azure Security Engineer Associate, Security+, Certified Cloud Security Professional certifications

Desired Skills:

This opportunity is available on a corp-to-corp basis or as a W2 position with a competitive benefits package. DataStaff, Inc. offers medical, dental, and vision coverage options as well as paid vacation, sick, and holiday leave. As many of our opportunities are long‑term, we also have a 401k program available for employees after 6 months.