Senior Cloud Security Engineer: Azure & DevSecOps Expert

LHH; San Francisco (CA); Hybrid; USD 180,000 - 250,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) plan with match

19 days of PTO + 11 paid holidays

Equity

Job summary

LHH is seeking a Sr. Cloud Security Engineer to join our client’s team in a full-time hybrid role based in San Francisco, CA.

This hands-on senior position will own the intersection of platform engineering, cloud security, and DevSecOps automation, turning security controls into code while protecting developer velocity. You will build secure infrastructure as code with Terraform, secure AKS, drive GitOps with Argo CD, and implement policy-as-code across the Azure cloud landing zone.

Qualifications

• 8+ years in DevOps, SRE, cloud security or related; senior-level track record in fast-moving environments.
• Hands-on Terraform with modules and IaC across environments.
• Strong Kubernetes security experience, preferably AKS in production.
• GitOps experience with Argo CD; Flux helpful if adapting quickly.
• Enterprise-grade DevSecOps across CI/CD security, scanning, policy-as-code, vulnerability management.
• Azure security depth preferred (Defender for Cloud, Sentinel, Entra ID, Key Vault, ACR, RBAC, PIM).
• Experience with ISO, SOC 2, NIST or similar compliance evidence automation.
• Ability to work independently in a startup-style environment.
• Clear communication, low ego, collaborative with eng, infrastructure, security, and GRC partners.
• Nice to have: AI/ML platform security exposure (Azure AI Foundry, MITRE ATLAS, NIST AI RMF).
• Nice to have: Azure AZ-500 or SC-100, Kubernetes CKS or other cloud/security credentials.
• Nice to have: experience in high-growth SaaS/startup/platform environments.

Responsibilities

• Build, author, and operate secure infrastructure as code using Terraform, including reusable modules and plans from scratch.
• Own Kubernetes platform security for AKS with hardened baselines and policy controls.
• Drive GitOps delivery with Argo CD, including manifest drift management and release automation.
• Build and operate secure CI/CD pipelines with SAST/DAST and SBOMs as automated gates.
• Implement policy-as-code and Azure-native controls across the cloud landing zone (Azure Policy).
• Operate and tune Azure security tooling (Defender for Cloud, Sentinel, Key Vault, Entra ID, RBAC, PIM).
• Partner with engineering and SRE to define monitoring policies, alerting, and incident workflows.
• Operationalize vulnerability management with remediation prioritization and reduced false positives.
• Support secure software supply chain with signed images, SBOMs, provenance, and hardened images.
• Contribute to ISO 27001/42001 and SOC 2 certification efforts with GRC partners.

Skills

Terraform

Kubernetes security

GitOps

DevSecOps

Azure security

Cloud security

Compliance

IaC

RBAC

PIM

Tools

AKS

Argo CD

Defender for Cloud

Sentinel

Key Vault

Entra ID

RBAC

PIM

Job description

LHH is seeking a Sr. Cloud Security Engineer to join our client’s team in a full-time hybrid role based in San Francisco, CA.

This hands-on senior position will own the intersection of platform engineering, cloud security, and DevSecOps automation, turning security controls into code while protecting developer velocity. You will build secure infrastructure as code with Terraform, secure AKS, drive GitOps with Argo CD, and implement policy-as-code across the Azure cloud landing zone.