Design and implement cloud security controls across Azure workloads (IaaS/PaaS), including network segmentation, Private Link/Private Endpoints, NSGs, Azure Firewall, and secure ingress/egress patterns.
Design and validate security controls for applications and platforms that process Protected Health Information (PHI), including encryption, access controls, logging, and secure data flows.
Support HIPAA and SOC 2 compliance by mapping technical controls to PHI risks, validating effectiveness, and producing audit ‑ ready evidence.
Deploy, configure, and operationalize Microsoft Defender for Cloud (secure score, regulatory compliance, recommendations, JIT access) and integrate findings into remediation workflows.
Serve as the primary Application Security (AppSec) engineer, partnering with Software Engineering to embed security controls across design, build, test, and runtime phases.
Perform threat modeling and architecture reviews for new applications, major changes, and integrations (data flows, identity, APIs).
Define and maintain application security requirements aligned to OWASP Top 10, API Security Top 10, and cloud-native threat models.
Engineer detections and response workflows in Microsoft Sentinel (analytics rules, automation rules, playbooks), including KQL-based hunting and incident triage.
Manage identity and access controls in Microsoft Entra ID, including RBAC, Conditional Access, MFA, Privileged Identity Management (PIM), and Managed Identities.
Harden internet-facing applications using Azure Web Application Firewall (WAF) and Azure Front Door (AFD) policies, aligning protections to OWASP Top 10 and validating through testing and logging.
Implement secure configuration baselines and policy-as-code using Azure Policy and Management Groups; define guardrails for encryption, logging, networking, and identity.
Build and maintain security logging and telemetry (Azure Monitor, Log Analytics, Defender, AFD/WAF logs), ensuring required retention, diagnostics settings, and centralized visibility.
Operate vulnerability management for cloud and application surfaces (e.g., Defender recommendations, scanning outputs), drive remediation prioritization, and validate fixes.
Integrate application security tooling into CI/CD pipelines (SAST, SCA, secrets scanning, IaC scanning), ensuring actionable results without disrupting delivery.
Triage and prioritize application vulnerabilities (code, dependencies, misconfigurations) based on risk, exploitability, and business impact.
Partner with engineering teams to remediate findings and validate fixes.
Secure secrets, keys, and certificates using Azure Key Vault, including access controls, rotation practices, and integration with applications and pipelines.
Secure APIs and web services using authentication, authorization, rate limiting, and abuse protections.
Validate WAF, AFD, and API gateway controls against application-specific threats, including bot abuse and injection attacks.
Monitor runtime application telemetry for security signals and collaborate on incident response when application-layer issues are identified.
Partner with engineering teams to embed secure SDLC practices: threat modeling, security requirements, secure configuration, and remediation guidance for OWASP Top 10 classes.
Review and improve Infrastructure-as-Code (Terraform/Bicep/ARM) for security and compliance, including least-privilege IAM, secure networking defaults, and drift detection.
Investigate security events and participate in incident response, including containment/eradication, evidence collection, and post-incident root cause analysis and lessons learned.
Oversee dependency and third-party library risk (SCA), including vulnerability tracking and remediation guidance.
Define secure patterns for secrets management, service-to-service authentication, and external integrations.
Support endpoint, identity, and cloud workload investigations using Microsoft Defender XDR and related telemetry; tune alerting to reduce noise and improve fidelity.
Maintain runbooks, playbooks, and security documentation; contribute to change management and control evidence for audits and risk assessments.
Conduct security reviews of cloud architecture and changes (new services, networking, identity, data flows), providing actionable recommendations and risk-based exceptions when needed.
Participate in, adhere to and support compliance and diversity, equity, and inclusion program objectives. Other duties as assigned.
Requirements
5+ years of experience in cloud security, security engineering, security operations, or cloud infrastructure roles with significant security responsibilities (Azure preferred)
Hands-on experience with Microsoft Defender (Defender for Cloud and/or Microsoft Defender XDR) and translating security findings into prioritized remediation
Experience with Microsoft Sentinel (or equivalent SIEM), including KQL queries, detection engineering, alert triage, and incident investigation
Strong understanding of Azure networking and security controls, including secure ingress/egress, firewalling, Private Link, and DNS considerations
Experience protecting web applications using WAF capabilities (Azure WAF/Application Gateway and/or Azure Front Door), including rule tuning and monitoring aligned to OWASP Top 10
Hands-on experience with application security practices, including threat modeling, secure design reviews, and remediation of OWASP Top 10 vulnerabilities
Understanding of API security, authentication/authorization patterns, and common web application attack techniques
Experience partnering with software engineers to drive secure coding practices and risk-based remediation
Solid grasp of identity and access management (Entra ID), RBAC, least privilege, Key Vault, and platform security controls required
Experience implementing governance guardrails using Azure Policy, Management Groups, and security baselines (e.g., Azure Security Benchmark) required
Experience reviewing and securing Infrastructure as Code (Terraform/Bicep/ARM), including secure defaults, secret handling, and drift detection preferred
Familiarity with DevSecOps practices (security scanning, policy enforcement, and automated evidence collection) integrated into CI/CD pipelines preferred
Experience with incident response processes, alert investigation, and post-incident reviews (RCA/lessons learned) preferred
Tech Stack
Azure
Cloud
DNS
SDLC
Terraform
Vault
Benefits
Health insurance
401K company match of up to 5%
No vesting requirement
20 days paid time off
4 weeks paid parental leave
9 paid holidays
Adoption Assistance Program
Flexible Spending Account
Educational Assistance Plan and Professional Membership assistance