Senior Cloud Security Engineer

Senior Cloud Security Engineer

Location: Mechanicsville, VA

Work Arrangement: Hybrid

Contract Type: 8+ months with potential to extend or convert to full-time

Experience Required: 12+ years

Candidate Location: Virginia – Local Candidates Only

Position Overview

Client is seeking an experienced Senior Cloud Security Engineer (Sr CSE) to implement and support the agency’s cloud and computing infrastructure. The Senior Cloud Security Engineer will serve as a subject matter expert supporting Client enterprise Azure migration, responsible for architecting, implementing, and securing cloud environments in alignment with SEC530 principles, Zero Trust, and enterprise compliance frameworks.

The Senior Cloud Security Engineer will be responsible for assisting in the design, implementation, securing, monitoring, and the continuous improvement of VDOT’s cloud infrastructure and services across the enterprise. The position provides senior-level technical leadership for cloud security architecture, identity and access management, network security, security monitoring, vulnerability management, incident response, and cloud governance.

The Senior Cloud Security Engineer works closely with Cloud Engineering, Network Engineering, Security Operations, Enterprise Architecture, Infrastructure, Application Development, DevOps, Risk Management, and IT leadership to ensure cloud environments are secure, resilient, compliant, and aligned with enterprise security standards.

Key Responsibilities

• Identify cloud security vulnerabilities, assess risk based on business impact, prioritize remediation, track remediation activities, and validate corrective actions.
• Lead complex cloud security initiatives and provide technical direction to engineers. Also assist in the design of secure cloud architecture for complex enterprise environments.
• Influence architecture and security decisions, prevent insecure configurations from reaching production, and implement security gates within deployment pipelines.
• Explain complex security risks to non-technical stakeholders.
• Assess cloud security risks and security gaps and recommend appropriate remediations. Create and maintain security documentation and evidence, as well as support audits and assessments.
• Review proposed cloud solutions for security risk and define appropriate security and compensating controls.
• Develop Azure policies to enforce standardization and compliance with enterprise requirements, as well as create Azure Automation runbooks to support incident response workflows.
• Monitor security events using SIEM technologies and work with VDOT’s SOC team to coordinate incident response activities.
• Identify and diagnose system problems and threats using system logs, line monitors, SIEM, diagnostic software, and test equipment.
• Lead investigation and containment of cloud security incidents.
• Review firewall and NSG rule requests and ensure compliance with security standards.
• Provide documentation, architecture topology diagrams, IP schemes, and access controls when required.
• Work independently on assigned projects.

Required Skills and Experience

Consolidated from the additional skills matrix supplied with the job description. All requirements below are marked Required in the original matrix.

Cloud Infrastructure, Architecture, and Engineering

• Enterprise Cloud Experience.
• Enterprise Cloud Security Experience.
• Strong hands-on expertise in cloud infrastructure and cloud engineering as a cloud security professional.
• Extensive experience in cybersecurity, networking, identity, security operations, and deep cloud engineering competency.
• In-depth experience moving between strategic architecture and hands-on engineering while identifying security risks.
• In-depth experience designing practical solutions, implementing controls, and working with infrastructure teams.
• In-depth experience working with application teams to continuously improve the organization's cloud security posture.
• Experience securing enterprise cloud environments and implementing security controls in production environments.

Azure Networking and Security Infrastructure

• Experience setting up Network Security Groups (NSGs), Resource Manager, management groups, monitoring, and Log Analytics.
• Experience setting up Azure Firewall, Azure WAF, Azure Monitor, Application Gateways, virtual networks, and network segmentation.

Incident Response, Monitoring, and Security Operations

• Experience in incident response, security investigations, log analysis, threat intelligence, security monitoring, and IOC analysis.
• Experience coordinating during cyber incidents.
• Experience with SIEM products, including Splunk and Microsoft Sentinel. CNAPP is also listed in the original skills matrix.
• Experience with log management, security analytics, SOC integration, threat detection, and threat hunting.
• Hands-on expertise validating indexer parsers and leveraging Splunk Query Language for monitoring and data analysis.
• Experience collaborating with the security governance team and application leads to implement enterprise log management standards.

Vulnerability Management and Cloud Security Posture

• Experience in vulnerability management, remediation tracking, and vulnerability scanning tools such as Nessus, Tenable, and Defender.
• Experience in cloud vulnerability management, remediation tracking, risk assessment, and prioritization.
• Experience in cloud risk assessment and prioritization, attack surface management, and Cloud Security Posture Management (CSPM).
• Experience in Cloud Workload Protection (CWPP) and Cloud-Native Application Protection Platform (CNAPP).

Security Governance and Compliance

• Experience with SEC530, CIS Benchmarks, NIST CSF, NIST 800-53, and Zero Trust principles.
• Experience working in highly regulated environments with large government agencies or similar regulatory environments.

Azure Policy and Security Automation

• Experience developing Azure Policy to enforce standardization and compliance with enterprise requirements.
• Experience creating Azure Automation runbooks to support incident response workflows.

Identity and Access Management

• Experience with Identity and Access Management (IAM), Role-Based Access Control (RBAC), and Privileged Access Management (PAM).
• Experience with least-privilege access and multi-factor authentication.

Communication and Technical Leadership

• Ability to communicate technical issues to technical, non-technical, and executive audiences.
• Ability to mentor junior engineers.

Required Certifications

• Azure Security Engineer Associate
• Security+
• Certified Cloud Security Professional or equivalent

The original matrix groups these qualifications under one required certification statement without specifying whether all are mandatory or whether an equivalent qualification satisfies the requirement.

Preferred Qualifications

• CCSP
• Designing Microsoft Azure Infrastructure (AZ-305)