Azure Cloud Security Engineer

Location: Washington, DC metro area | Hybrid, four days onsite per week

Clearance: Active Secret required; ability to obtain Top Secret

Position Overview: Our client is seeking an Azure Cloud Security Engineer to secure an enterprise Azure platform supporting a federal customer. The role emphasizes security governance, architecture reviews, and direct customer guidance, supported by hands-on Azure security experience. You will help application teams deploy securely, maintain tenant-wide controls, and apply Zero Trust principles across infrastructure, data platforms, and emerging AI services.

Key Responsibilities: Advise customer teams on secure architecture, service configurations, access design, and workload deployment. Review proposed changes and existing configurations, providing clear security recommendations and reference guidance. Explain landing zone templates and shared security responsibilities as customers assume management of their environments. Secure deployed workloads and maintain tenant-wide controls through Conditional Access, Azure Policy, and Microsoft Defender for Cloud regulatory compliance. Evaluate and apply new Microsoft security features and Zero Trust capabilities. Apply least privilege, mutual authentication, default-deny access, and tenant isolation to services such as Azure Databricks and AI workloads. Guide audit and diagnostic logging architecture, traceability, and security reporting requirements. Automate security and management activities through scripting.

Required Qualifications: Active Secret clearance and ability to obtain Top Secret. At least three years of hands-on experience securing Microsoft Azure environments. Strong Azure infrastructure security fundamentals. Hands-on experience with Conditional Access, Azure Policy, and Microsoft Defender for Cloud. Solid understanding of Zero Trust, shared responsibility, least privilege, mutual authentication/mTLS, tenant isolation, access controls, and continuous authentication. Scripting experience for security or platform management. Strong written and verbal communication skills, including frequent direct customer interaction through Microsoft Teams and other collaboration tools. Ability to learn new services quickly and adapt to evolving responsibilities. Availability to work onsite four days per week in the Washington, DC metro area.

Preferred Qualifications: AZ-500 certification, strongly preferred; AZ-104, SC-300, SC-900, or SC-200 also valued. Azure CLI, Microsoft Graph PowerShell, Terraform, or Python. Working knowledge of NIST SP 800-53.Experience securing Azure Databricks or other data platforms. Exposure to AI model governance and security. Familiarity with SOC operations and logging requirements.