Cybersecurity Engineer (Cloud)

Purpose and scope The Cloud Security Engineer implements and maintains security controls across commercial and government cloud environments, including Microsoft 365 Commercial and GCC High, Azure, AWS, hybrid-cloud services, and approved cloud-based artificial intelligence services. The role turns security architecture and regulatory requirements into working guardrails, configurations, automation, control evidence, and telemetry. Success requires hands-on cloud engineering and a working understanding of government, defense-industry, privacy, and international security frameworks. A central responsibility is implementing the controls needed to adopt generative AI, machine learning, enterprise copilots, and agentic systems safely across commercial, government, and CUI environments. The role also administers assigned cloud security platforms and supports risk assessment, control testing, remediation, and audit readiness. This role reports to the Senior Cybersecurity Architect & Senior Manager. Essential responsibilities Cloud security engineering Implement and maintain security controls across Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid services, including cloud guardrails, secure landing zones, workload protections, and virtual desktop environments. Configure and test security policies, infrastructure-as-code controls, deployment automation, and supporting integrations in coordination with cloud platform and application owners. Review technical findings, troubleshoot control failures, and recommend practical configuration changes that reduce risk without unnecessarily disrupting services. Cloud security platform administration Administer assigned cloud security posture management and workload protection capabilities, including environment onboarding, policy configuration, security recommendations, coverage monitoring, and alert integrations. Maintain platform health and configuration, tune controls, document exceptions, and identify gaps in cloud coverage. Integrate cloud security telemetry with Security Operations and the managed security service provider. Support escalated investigations when cloud expertise is needed. Coordinate exposure prioritization and tracking with Vulnerability Management and work with cloud platform owners on remediation. The role does not own the underlying cloud services or their remediation queues. Government cloud and compliance engineering Implement and validate technical controls that support CMMC and applicable NIST requirements, including NIST SP 800-171 and NIST SP 800-172. Support Microsoft 365 GCC High and CUI workloads with an understanding of government-cloud service limitations, tenant and security boundaries, data handling requirements, and controlled connectivity with commercial environments. Translate applicable requirements from DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, and other relevant frameworks into practical cloud configurations in coordination with Risk and Compliance. Perform technical risk assessments and control testing; maintain implementation records, evidence, exceptions, and remediation status for assessments and audits. Artificial intelligence and agent security Implement and operate security controls for approved AI and machine-learning services, enterprise copilots, generative AI applications, retrieval-augmented generation, agents, and tool integrations. Configure identity and access controls, data-source permissions, secrets handling, execution boundaries, sandboxing, tool restrictions, human approval controls, network egress, logging, and other safeguards defined by Architecture. Test controls against risks such as prompt injection, indirect prompt injection, sensitive-data exposure, unsafe tool execution, over-privileged agents, unapproved model or service use, and manipulation of grounding content. Evaluate AI service configurations and new platform features for security, privacy, data residency, government-cloud availability, and CUI handling before implementation. Automate repeatable AI security configurations and validation checks through policy, scripting, infrastructure as code, and deployment pipelines where practical. Integrate relevant AI activity and security telemetry with enterprise monitoring and support investigations requiring AI expertise. Collaboration and documentation Work with Identity, Network Security, Data Security, Detection and Incident Response, IT, connected program sites, and application teams to implement controls within their areas of responsibility. Maintain configuration standards, implementation guides, diagrams, operating procedures, and support documentation for assigned cloud security capabilities. Translate applicable security and regulatory requirements into technical configurations and provide evidence or technical input for assessments and audits when requested. Stay current on cloud and AI security threats and recommend improvements based on observed risk, platform changes, and operational experience. Participate in 2nd-level Security Operations Center (SOC) activities, e.g. respond to critical security incidents escalated by a MSSP. Provide off-hours support on an infrequent, but as needed basis. Performs other duties as assigned.   Knowledge, Skills, & Abilities Working knowledge of cloud identity, network security, data protection, logging, posture management, and workload protection concepts. Working knowledge of generative AI and agentic-system security risks, including data exposure, prompt injection, tool and connector permissions, agent identities, secure execution, and audit logging. Ability to support technical risk assessments, control testing, remediation documentation, and audit evidence collection. Ability to troubleshoot technical issues, document work clearly, manage priorities, and collaborate with technical and non-technical partners. Minimum qualification