Senior Cloud Security Engineer

Job Title: Senior Cloud Security Engineer
Work Type: Hybrid
Location: Mechanicsville, VA 23116
Salary/Rate: Maximum Vendor Rate: $122.87/hour
Start Date: November 9, 2026
End Date: June 30, 2027
Industry Category: Information Technology / Cybersecurity
Employment Type: Contract
Requisition ID: 813222

Overview:

VDOT is seeking an experienced Senior Cloud Security Engineer to support its enterprise Azure migration and secure cloud infrastructure. This senior-level role combines cloud security architecture, hands-on engineering, risk management, security monitoring, and incident response. The successful candidate will help ensure cloud environments meet enterprise security standards, Zero Trust principles, and applicable compliance requirements.

Application:

• Resume Submission Deadline: Friday, October 23, 2026.
• Candidates should demonstrate strong hands-on Azure security engineering experience, enterprise cloud security expertise, and experience working in complex or regulated environments.

Job Description:

The Senior Cloud Security Engineer will provide technical leadership for securing and improving VDOT’s enterprise cloud infrastructure, with a focus on Microsoft Azure. The role involves designing secure cloud architectures, implementing security controls, reviewing configurations, managing vulnerabilities, and coordinating security monitoring and incident response. The engineer will collaborate with cloud, network, infrastructure, application, DevOps, security operations, and governance teams to reduce risk and maintain compliance.

The position requires the ability to move between strategic security architecture and practical, hands-on engineering.

Responsibilities:

• Design, implement, secure, monitor, and continuously improve enterprise cloud infrastructure and services.
• Lead complex cloud security initiatives and provide technical guidance and mentoring to junior engineers.
• Identify cloud security vulnerabilities, assess business risks, prioritize remediation, track corrective actions, and validate fixes.
• Review cloud architectures and proposed solutions, recommend appropriate security and compensating controls, and prevent insecure configurations from reaching production.
• Implement security gates within deployment pipelines and promote secure engineering practices.
• Develop Azure Policies to enforce enterprise security standards and compliance requirements.
• Create Azure Automation runbooks to support incident response workflows.
• Configure and review Azure networking security, including Network Security Groups (NSGs), Azure Firewall, Web Application Firewall (WAF), Application Gateways, virtual networks, and network segmentation.
• Monitor security events using SIEM tools and coordinate with VDOT’s Security Operations Center (SOC) during investigations and incidents.
• Lead cloud security incident investigations, containment, log analysis, threat detection, and remediation activities.
• Support vulnerability scanning, attack surface management, cloud security posture management, and cloud workload protection.
• Maintain security documentation, architecture diagrams, network and IP schemes, access controls, and audit evidence.
• Collaborate with application teams, security governance, and infrastructure teams to improve cloud security and enterprise log management.
• Explain technical risks and recommendations to technical teams, nontechnical stakeholders, and executive audiences.
• Work independently on assigned projects and contribute to security assessments, audits, and continuous improvement initiatives.

Requirements

Minimum Requirements:

• Enterprise cloud experience: At least 8 years of experience working with enterprise cloud environments.
• Enterprise cloud security experience: At least 5 years of experience securing enterprise cloud infrastructure and implementing security controls in production.
• Strong hands-on experience in cloud infrastructure, cloud engineering, cybersecurity, networking, identity and access management, and security operations.
• Experience designing secure cloud architectures, implementing practical security controls, assessing risks, and collaborating with infrastructure and application teams.
• Hands-on Microsoft Azure experience with management groups, resource management, NSGs, Azure Firewall, Azure WAF, Azure Monitor, Log Analytics, Application Gateways, virtual networks, and network segmentation.
• Experience with incident response, security investigations, log analysis, threat intelligence, security monitoring, indicators of compromise (IOC) analysis, and cyber incident coordination.
• Experience with vulnerability scanning tools such as Nessus, Tenable, or Microsoft Defender, including remediation tracking and risk prioritization.
• Experience with SIEM and cloud security tools such as Splunk, Microsoft Sentinel, and Cloud-Native Application Protection Platforms (CNAPP).
• Knowledge of log management, security analytics, SOC integration, threat detection, and threat hunting.
• Hands-on experience validating Splunk indexer parsers and using Splunk Query Language for monitoring and data analysis.
• Experience working with security governance teams and application leads to implement enterprise log management standards.
• Experience applying SEC530 principles, CIS Benchmarks, NIST Cybersecurity Framework (NIST CSF), NIST SP 800-53, and Zero Trust principles.
• Experience with cloud risk assessment, attack surface management, cloud security posture management, cloud workload protection (CWPP), and CNAPP solutions.
• Experience developing Azure Policies and creating Azure Automation runbooks for security and incident response.
• Experience with identity and access management (IAM), role-based access control (RBAC), privileged access management (PAM), least-privilege access, and multi-factor authentication (MFA).
• Experience working in highly regulated environments, preferably with large government agencies or organizations with similar compliance requirements.
• Strong communication skills, including the ability to explain complex security issues to technical, nontechnical, and executive audiences.
• Ability to mentor junior engineers and work independently.
• Required certifications: Azure Security Engineer Associate, CompTIA Security+, and Certified Cloud Security Professional (CCSP).

Preferred Qualifications:

• Microsoft Designing Microsoft Azure Infrastructure certification (AZ-305).
• Additional experience with enterprise cloud architecture, cloud governance, and security compliance frameworks.

Benefits

Compensation:

• Pay Rate: $122.87 per hour.

Schedule:

• Contract assignment running from November 9, 2026, through June 30, 2027.

Work Location:

• Mechanicsville, VA 23116.