We are seeking a hands-on
Cloud Security Engineer with practical experience in Azure and/or AWS who can help build and operate core cloud security controls while integrating security into AI/ML workflows. This foundational role will partner across teams to deliver measurable improvements in identity, network segmentation, data protection, logging/monitoring, and compliance for DoD and government workloads. This role is located in our
Clarksburg, MD office and will report to the Director of Cybersecurity.
Responsibilities- Establish baseline cloud security controls (IAM/Entra ID, network segmentation, encryption, logging) with dashboards and runbooks.
- Deploy or tune CSPM/CWPP tooling; reduce misconfigurations and critical findings by agreed targets.
- Deliver audit-ready evidence for FedRAMP/CMMC/NIST SP 800-53 control families in scope.
- Stand up detections for cloud and AI-specific threats in Microsoft Sentinel or equivalent SIEM; document response playbooks.
- Design and operate security controls across Azure/AWS: IAM/Entra ID, VNet/VPC controls, NSGs/Security Groups, WAF, private endpoints/PrivateLink.
- Implement Zero Trust/least privilege patterns; establish guardrails. (Azure Policy, AWS SCPs, OPA/Gatekeeper).
- Deploy and maintain CSPM/CWPP tooling and integrate with SIEM (Microsoft Sentinel / Splunk).
- Protect AI/ML pipelines pragmatically: secure training data, model repos, and inference endpoints; apply access controls and logging.
- Conduct threat modeling and risk assessments; document findings with prioritized remediation plans and partner follow-through.
- Support compliance for FedRAMP, CMMC, NIST SP 800-53; produce artifacts and evidence for audits.
- Maintain runbooks, diagrams, and SOPs; drive continuous improvement through metrics.
Qualifications The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
- U.S. Citizenship required. - Applicants selected may be subject to a government security investigation and must meet eligibility requirements for access to classified information.
- Bachelor's degree in a technical field or equivalent experience.
- 3 - 6 years in cybersecurity with 2+ years focused on Azure and/or AWS security in enterprise or government environments.
- Hands-on experience with IAM, network security, encryption, logging/monitoring, and CSPM/CWPP tools.
- Experience with infrastructure-as-code and policy-as-code; scripting for automation (PowerShell/Python/Bash).
- Working knowledge of compliance frameworks (FedRAMP, CMMC, NIST SP 800-53, DoD Cloud SRG).
- Strong communication and collaboration skills; ability to document and drive cross-team remediation.
- Ability to participate in a rotating on-call schedule to support continuous service and respond to priority issues as needed
Preferred- Certifications: CISSP, CCSP, CISM, Azure Security Engineer, Security+.
- Experience integrating security into MLOps, LLMs, or generative AI applications.
- Container/Kubernetes security experience; service mesh and runtime protections.
- Experience with Azure Stack Edge family of devices.
- Experience with DoD networks, especially classified and operational networks.
- Understanding of enterprise networking concepts, especially Virtual Private Networks (VPNs), tunneling, QoS, and cloud connectivity solutions (e.g. Azure Express Route).
The annualized pay range for this role is
$88,920.00 - $120,000.00 USD along with a target incentive compensation plan (ICP) of 5%. The pay range provided is a good faith estimate representative of the experience level for the role described above. TDSI considers several factors when extending an offer, including but not limited to, the role, function and associated responsibilities, a candidate's work experience, location, education/training, and key skills.
For specific questions about this job posting, candidates may contact talent acquisition at careers@thalesdsi.com.
