US LBM Cybersecurity Engineer – Azure DevSecOps

US LBM is one of the leading distributors of specialty building materials in the United States, and they are seeking a Cybersecurity Engineer – Azure DevSecOps. This role is responsible for securing cloud-native application workloads and requires a strong software engineering background to manage security throughout the application lifecycle.

Responsibilities:

• Implement and manage Microsoft Defender for Cloud (CNAPP) across Azure workloads, covering both cloud security posture management (CSPM) and cloud workload protection (CWPP) for virtual machines, Azure Kubernetes Service (AKS) containers, and serverless functions
• Own the DevSecOps program using Snyk for SAST, DAST, and software composition analysis (SCA), integrated directly into CI/CD pipelines (Azure DevOps, GitHub Actions)
• Write and maintain Infrastructure as Code (Terraform, Bicep, ARM templates) with security controls embedded by default — policy-as-code and guardrails rather than after-the-fact review
• Secure data platform integrations between Azure workloads and downstream data services, including Azure-native platforms (Cosmos DB), third-party managed databases (MongoDB Atlas), streaming platforms (RedPanda), and SaaS data warehouses (Snowflake), covering identity/access boundaries, encryption, and data flow security
• Secure containerized workloads running on Azure Kubernetes Service (AKS), including cluster hardening, workload identity, network policy, and image scanning integrated into the CI/CD pipeline
• Partner directly with application developers to embed security into the software development lifecycle — code review participation, secure coding guidance, and remediation support for vulnerabilities identified by Snyk
• Build and maintain custom tooling, scripts, and APIs to automate security checks, policy enforcement, and reporting across the cloud-native environment
• Conduct threat modeling for cloud-native workloads and their data integrations, developing corresponding detection and automation use cases
• Evaluate and integrate new cloud-native and data platform technologies as the organization's architecture evolves, including technology integration from mergers and acquisitions
• Secure the adoption of AI-assisted development tools (e.g., Cursor, Claude Code) and AI agent/model platforms (e.g., Azure AI Foundry), including governance of code and secrets exposure, access scoping for AI coding agents, and safe integration of AI-generated code into the CI/CD pipeline
• Ensure DevSecOps and cloud-native practices align with Zero Trust and NIST Cybersecurity Framework principles
• May design and build internal web applications for the Cybersecurity Solutions team, such as security reporting dashboards, self-service tooling, and workflow automation portals

Requirements:

• Minimum Education required - Bachelor's degree in Computer Science, Software Engineering, Information Systems, or equivalent experience required
• Minimum 3-5 years of professional software development or DevOps engineering experience, with at least 1-2 years focused on security
• Prior experience as a software engineer, DevOps engineer, or platform engineer — hands-on coding experience is required, not just security tooling experience
• Proficiency in at least one modern programming language (Python, C#/.NET, Go, or JavaScript/TypeScript) — able to read, write, and debug application code
• Hands-on experience with CI/CD pipelines (Azure DevOps, GitHub Actions, or similar) and Infrastructure as Code (Terraform, Bicep, or ARM templates)
• Experience integrating or securing cloud-native data platforms — Cosmos DB, MongoDB Atlas, RedPanda, Snowflake, Databricks, or similar managed data and streaming services
• Familiarity with Microsoft Defender for Cloud or comparable CNAPP/CWPP/CSPM tooling
• Experience with Kubernetes/Azure Kubernetes Service (AKS) — container orchestration, cluster security configuration, and securing containerized workloads
• Understanding of the security implications of AI-assisted software development — including AI coding assistants (Cursor, Claude Code) and AI agent/model platforms (Azure AI Foundry) — and how to govern their access to code, secrets, and infrastructure
• Experience with SAST/DAST/SCA tools (Snyk preferred; Checkmarx, Veracode, or similar acceptable)
• Understanding of API design, authentication (OAuth2, service principals, managed identities), and secure service-to-service integration patterns
• Ability to communicate security requirements to developers in terms that fit their existing workflow, rather than requiring separate security-only processes
• Strong understanding of security frameworks such as Zero Trust and the NIST Cybersecurity Framework
• Able to support multiple concurrent workstreams in a highly matrix, fast-paced, multi-site organization experiencing rapid growth
• Strong interpersonal and communication skills, with a collaborative, developer-friendly approach to security
• Must be a self-starter with a builder's mindset — comfortable writing tools and automation rather than relying solely on vendor dashboards
• Travel required to various operating locations along with business-related meetings & conferences
• Physical demands include sitting for extended periods of time, standing and walking, bending or stooping, lifting up to 25 pounds frequently and up to 50 pounds on occasion. Lifting equipment such as PC CPU's and monitors and transporting to various locations
• Relevant certifications preferred (e.g., AZ-204 Developer Associate, AZ-500, CKA/CKAD, Snyk certifications, Terraform Associate)