Cyber Security Cloud Engineer

National Carwash Solutions is seeking a Cyber Security Cloud Engineer to implement and operate security controls across its cloud, SaaS, identity, workload, and data environments. The role also leads security integration for acquired companies, partners with engineering and DevOps teams on product and development security, and supports compliance and approved AI initiatives.

Responsibilities:

• Implement and maintain security controls across Azure and AWS in accordance with NCS security requirements and the enterprise security framework, including identity and access management, network segmentation, encryption and key management, logging, and workload protection
• Deploy and operate cloud security posture management (CSPM/CNAPP), infrastructure-as-code guardrails, policy-as-code, and automated compliance checks that enforce required baselines and provide continuous evidence of control effectiveness
• Operate and tune cloud-native security services (e.g., Microsoft Defender for Cloud, Microsoft Sentinel, Entra ID Protection, AWS GuardDuty, Security Hub, CloudTrail, IAM Access Analyzer) and integrate cloud telemetry into enterprise SIEM detection and response workflows
• Execute detection engineering and incident response for cloud-hosted and identity-centric threats, including alert triage, investigation, root cause analysis, containment, and remediation coordination with managed security providers, following established playbooks and escalation paths; track emerging cloud attack techniques and recommend updates to detections, hardening, and response procedures
• Support cybersecurity due diligence for acquisitions by executing technical assessments of target environments and documenting gaps against NCS security requirements to inform prioritized integration plans
• Execute the secure integration and migration of acquired companies onto NCS platforms, including identity consolidation into Microsoft Entra ID, tenant-to-tenant Microsoft 365 migrations, workload migrations to Azure and AWS, network and endpoint onboarding, and decommissioning of legacy infrastructure
• Maintain and follow repeatable, documented integration playbooks and security baselines that bring acquired entities to the required security standard within defined integration timelines, with status reporting throughout
• Implement and operate required security controls across the CI/CD pipeline in partnership with Product Engineering and DevOps teams, including static and dynamic application security testing (SAST/DAST), software composition analysis, secrets scanning, container image scanning, and software bill of materials (SBOM) generation, with risk-based gates that protect release velocity
• Support secure product development for NCS software, connected equipment, and customer-facing platforms through threat modeling, secure design reviews, application of secure coding standards, API security, and vulnerability management, with particular attention to payment-enabled and field-deployed systems
• Track product security metrics, maintain developer-facing documentation, and uphold remediation SLAs that give engineering teams clear, actionable ownership of security findings
• Implement the data protection, DLP, identity governance, and access controls required to securely enable approved AI initiatives, including Microsoft 365 Copilot, Azure OpenAI, AWS Bedrock, and enterprise AI tooling, in partnership with Data, IT, and business teams
• Maintain security controls across Microsoft 365, identity, endpoint (Windows and Apple), and cloud platforms in line with NCS security requirements; produce the evidence, metrics, and documentation needed for PCI-DSS compliance, NIST CSF alignment, internal and external audits, executive security reviews, and customer security assessments
• Mentor engineers, serve as the escalation point for complex cloud and identity security issues, and report clearly on control status, gaps, risk, and remediation progress to technical and executive audiences

Requirements:

• 5 or more years of progressive experience in IT, with broad exposure to infrastructure, networking, identity, and enterprise systems
• 3 or more years of hands-on experience in a dedicated cybersecurity role, including securing production workloads in Microsoft Azure and/or AWS
• Demonstrated experience implementing security controls within an established enterprise security framework, including translating defined control requirements, audit findings, and assessment results into deployed, documented, and measurable controls
• Hands-on implementation experience with cloud security services and patterns on at least one major platform (Azure or AWS) and solid familiarity with the other, including IAM, network security, encryption and key management, logging, and workload protection
• Experience with infrastructure as code (e.g., Terraform, Bicep, CloudFormation), CI/CD platforms (e.g., Azure DevOps, GitHub, GitLab), and application security tooling (SAST/DAST, SCA, secrets and container scanning), with a track record of partnering with development teams to embed security into the SDLC
• Working knowledge of the NIST Cybersecurity Framework and experience supporting PCI-DSS compliance and audit or assessment processes, including evidence collection and remediation tracking
• Clear, professional written and verbal communication, with the ability to report control status, gaps, and remediation progress to technical and non-technical audiences
• eligible to work in the United States
• not currently able to sponsor work visas
• One or more current, industry-recognized security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft Certified: Azure Security Engineer Associate (AZ-500); equivalent demonstrated experience will be considered
• Direct experience executing security workstreams for mergers, acquisitions, or divestitures, including tenant-to-tenant migrations and identity consolidation
• Experience securing AI/ML platforms and services (Azure OpenAI, AWS Bedrock, Microsoft 365 Copilot, enterprise data platforms) and familiarity with the NIST AI RMF, OWASP Top 10 for LLM Applications, or similar frameworks
• Experience with CSPM/CNAPP platforms, container and Kubernetes security, and secrets management
• Experience implementing or maturing a product or application security program, including familiarity with OWASP ASVS and SAMM, NIST SSDF, or similar secure development frameworks, and tooling such as GitHub Advanced Security or equivalent integrated DevSecOps platforms
• Experience securing embedded, IoT, or payment-enabled products, including PCI-DSS considerations for software and device design
• Scripting and automation proficiency (PowerShell, Python, etc.) for detection engineering and security tooling
• Experience in manufacturing, distribution, or field service environments, including connected equipment and payment systems