Cloud Security Engineer - Azure Cloud Migration

CitiusTech is hiring a Cloud Security Engineer to secure and validate workloads during a multi-wave data center migration to Microsoft Azure for a U.S. healthcare payer. The role owns security reviews, identity and network control validation, migration approval evidence, monitoring integration, compliance support, and operational handover.

Responsibilities:

• Define and maintain the Azure security baseline for migrated workloads: Azure Policy initiatives, Defender for Cloud, encryption at rest and in transit, and diagnostic settings, aligned with the landing zone and Zero Trust principles
• Review each application's design and migration playbook for security before approval, and map its controls to HIPAA, HITECH, and HITRUST requirements
• Keep security patterns, checklists, and diagrams current so the migration team applies them the same way every time
• Work with the Identity team on the move from on-premises Active Directory to Entra ID and Entra Domain Services: assess the impact on Kerberos, service accounts, and domain join for each application
• Validate RBAC assignments, least privilege, PIM, Conditional Access, MFA, and break-glass accounts
• Support onboarding of privileged accounts and administrative sessions to CyberArk, and confirm Bastion-only administration
• Make sure secrets, keys, and certificates are held in Key Vault, and that certificates stay valid through cutover
• Review and validate Azure Firewall rules, NSGs, segmentation, private endpoints, and private access paths for each workload
• Confirm migrated workloads reach on-premises systems only through approved paths, using firewall logs as evidence
• Run a pre-migration security readiness assessment for each application
• Validate security configuration during cutover and hypercare, and drive quick remediation of findings without stalling the wave
• Provide the security evidence for each approval gate and CAB submission
• Confirm security telemetry from every migrated workload reaches the SIEM (Microsoft Sentinel, with Splunk during the transition) and that alerts fire as expected
• Support incident response and root-cause analysis for migrated workloads
• Collect and maintain compliance evidence: access controls, encryption, logging, and retention
• Track security gaps to closure, and support risk assessments and audit requests
• Hand over to operational security teams with runbooks and knowledge transfer after each wave

Requirements:

• 10+ years in information or cloud security engineering, including 3+ years hands-on securing Microsoft Azure workloads
• Strong working knowledge of Azure Policy, Defender for Cloud, RBAC, PIM, Conditional Access, Key Vault, and diagnostic settings
• Azure network security: Azure Firewall, NSGs, private endpoints, and hub-and-spoke or Virtual WAN designs
• Security delivery on at least one data center to Azure migration
• Hybrid identity: Entra ID with on-premises Active Directory, including Kerberos, service accounts, and domain services
• SIEM integration and log validation with Microsoft Sentinel or Splunk
• Experience in healthcare, working under HIPAA
• Health plan or payer organizations
• Entra Domain Services, and CyberArk Privilege Cloud or PAS
• HITRUST assessments and evidence collection
• Azure landing zones, the Cloud Adoption Framework, and Zero Trust
• Policy as code, and reviewing Bicep templates for security
• Zscaler, Palo Alto, or certificate management platforms such as Venafi
• Azure Security Engineer Associate (AZ-500)
• Identity and Access Administrator Associate (SC-300)
• Cybersecurity Architect Expert (SC-100)