Position Summary:As a Security Engineer, Cloud and AI on the Information Security Team within Information Technology, you will play a key role in securing NAR's cloud environments, AI-assisted development practices, and modern application portfolio supporting both NAR staff and the membership. This is a hands-on individual-contributor role with ownership of cloud security architecture and AI security governance decisions, within established enterprise standards and under the direction of the IT Security Director.
You will work at the intersection of security, cloud engineering, and software development, partnering closely with the Application Development, Data, and Infrastructure teams as NAR accelerates its adoption of AI-assisted development tools, agentic AI workflows, and cloud-native applications on Microsoft Azure. Success in this role means enabling the business to move fast with AI and cloud technologies while keeping risk visible, measurable, and managed. You will complement the existing security team, sharing responsibility for security monitoring and incident response while owning the cloud security, application security, and AI security domains.
Duties and Responsibilities:
- Own cloud security posture across NAR's Microsoft Azure environments, including configuration hardening, identity and access controls, network security, workload protection, and cost-aware security architecture.
- Serve as the security partner to the Application Development team, embedding security into the software development lifecycle: threat modeling, secure design reviews, code review support, and DevSecOps practices within Azure DevOps CI/CD pipelines.
- Lead security governance for AI-assisted development, including AI coding assistants, agentic AI workflows, and LLM-based applications, ensuring adoption aligns with NAR's AI Use Policy and industry frameworks such as the NIST AI RMF and OWASP Top 10 for LLM Applications.
- Assess, pilot, and secure AI agents and automation used across the organization, including agent permissions, non-human identities, secrets management, and data access boundaries.
- Implement and operate application and cloud security tooling, including SAST, DAST, software composition analysis, cloud security posture management, and container/workload security.
- Assist in the design and enforce identity and access management controls for cloud and application workloads, including OAuth/OIDC-based SSO patterns, service principals, managed identities, and privileged access.
- Share responsibility with the security team for triaging and responding to security alerts from MDR, SIEM, and other detection platforms, and participate in incident response for cloud and application-related events.
- Support vulnerability management and penetration testing activities for cloud infrastructure and applications, including remediation guidance and validation.
- Collaborate with compliance partners to ensure cloud and AI solutions meet organizational policies, contractual obligations, and regulatory requirements.
- Develop security guardrails, reference architectures, and paved-road patterns that make the secure path the easy path for development teams.
- Create and maintain clear documentation for security architectures, standards, and AI security guidance.
- Share knowledge with the security team on cloud and AI security topics, and provide security enablement to developers.
- Stay current with emerging AI security threats, cloud services, and industry trends, recommending improvements as appropriate.
- Other duties, as assigned.
Basic Qualifications: - Bachelor's or Master's degree in Cybersecurity, Computer Science, Engineering, or a related field (or equivalent practical experience).
- 5+ years of professional experience in information security or a combined security and software engineering background, with at least 2 years focused on cloud security in production environments.
- Strong hands-on experience securing Microsoft Azure, including:
- Microsoft Defender for Cloud, Microsoft Sentinel, and Azure-native security controls
- Microsoft Entra ID, conditional access, service principals, and managed identities
- Azure networking, key management, and workload security
- Software development background with the ability to read, review, and write code in at least one modern language (such as C#, Python, JavaScript/TypeScript, or Java) and to engage credibly with full-stack development teams.
- Practical experience securing CI/CD pipelines and integrating security tooling into Azure DevOps or comparable platforms.
- Hands-on experience with AI coding tools (such as copilots or code assistants) and a working understanding of the security risks they introduce, including insecure generated code, data leakage, and supply chain exposure.
- Working knowledge of securing REST APIs, web applications, and distributed systems, including OAuth/OIDC authentication and authorization patterns.
- Strong understanding of security architecture, threat modeling, cloud shared responsibility, and the full software development lifecycle.
- Ability to work independently, make sound risk-based decisions, and take ownership of complex security implementations.
- Strong written and verbal communication skills, including the ability to explain security concepts to developers, business stakeholders, and leadership, and to position security as a business enabler.
Preferred Qualifications: - Security certifications such as CISSP, CCSP, AZ-500, or equivalent.
- Experience with AI security frameworks and threat models, including NIST AI RMF, OWASP Top 10 for LLM Applications, and MITRE ATLAS.
- Experience securing agentic AI systems, non-human identities, and machine-to-machine authentication at scale.
- Experience with infrastructure-as-code security (such as Terraform or Bicep scanning) and policy-as-code.
- Familiarity with securing Microsoft Power Platform solutions, including Power Apps and Power Automate.
- Experience supporting security in application modernization or large-scale cloud migration efforts.
- Familiarity with data protection and DLP controls in cloud and SaaS environments.
What success looks like in this role: - You give NAR the confidence to adopt AI-assisted development and agentic workflows quickly and safely, with clear guardrails instead of blockers.
- You take strong ownership of cloud security posture, and measurable risk reduction is visible across Azure environments and application pipelines.
- Development teams see security as a partner: secure patterns are documented, easy to follow, and built into the delivery process.
- You strengthen the overall security team by sharing detection and response duties and mentoring teammates on cloud and AI security.
- You are a trusted technical contributor who partners well with cross-functional teams to deliver business value securely.
Compensation: $150,000 -$170,000 depending on office location
NAR provides comprehensive benefits including health/dental/vision insurance.
NAR is on a hybrid schedule and in the office 3 days a week.
