Embed security controls, monitoring, and compliance automation across the software development lifecycle (SDLC) for internally developed and low-code (Power Platform) applications handling business data and customer sensitive data.
Engineer and operate secure, resilient CI/CD pipelines across the Power Platform and GitHub with automated quality and security gates (SAST, DAST, dependency, container, infrastructure-as-code scanning, secrets detection, SBOM generation).
Provide direct support to developers. Implement, tune, and maintain cloud security guardrails (Azure, M365, Power Platform) including data protection, configuration baselines, and zero-trust principles.
Lead/assist in incident response and vulnerability management – rapid triage, containment, remediation, root cause analysis (RCA), and post-incident improvement actions.
Provide security guidance, threat modeling (STRIDE/PASTA/ATT&CK input), and coaching to developers, analysts, and stakeholders to improve secure design and release quality metrics.
Network security operations, define and enforce network segmentation, VNet/subnet configurations, and security groups in AWS/Azure, implement firewall rules, NSGs, and service endpoint protections, validate zero trust principles in cloud network design
Position Requirements:
Holding one of the following certifications: Security+, CISSP, CND, or CASP+
U.S. work authorization and the ability to obtain or maintain a Secret clearance
Experience deploying and monitoring web applications in AWS and/or Azure
Availability for limited after-hours/on-call participation during critical incidents or 24 -hour war-room responses
Adhere to organizational policies, confidentiality, and handling standards for sensitive data.
Design, implement, and secure containerized workloads using Docker and Kubernetes, with a strong emphasis on Linux-based environments, image scanning, runtime protection, and policy enforcement.
Build and track security using automation, Snyk for packages and Solution Checker for Power Platform and Power Apps
Deep understanding of identity and access management, encryption standards, network protocols
Bachelor’s degree in Computer Science, Cybersecurity, or related fields
Active Secret clearance
Knowledge of compliance automation
General Experience:
5+ years combined experience in DevOps, Cybersecurity Engineering, Cloud Engineering, or related roles supporting production workloads.
Demonstrated history of automating build/deploy pipelines and implementing security testing/monitoring at scale.
Functional Responsibility:
Owns definition, implementation, and continuous improvement of DevSecOps practices, pipelines, and controls
Translates regulatory and contractual requirements (such as NIST 800-53) into automated, testable controls and evidence collection.
Designs and maintains standardized Infrastructure as Code (IaC) and security baselines; ensures traceability from risk to mitigation.
Coordinates with product owners to align remediation priorities with business impact and risk appetite.
Specialized Experience:
Hands-on with Azure (Entra ID, Key Vault, Defender for Cloud), Microsoft Power Platform (Power Apps, Power Automate, Dataverse, SharePoint) security configuration and integration with traditional software services.
Hands-on with Docker, Kubernetes container technologies and Linux operating system
Continuous Integration and Continuous Deployment (CI/CD) tooling (GitHub Actions, Azure DevOps pipelines) including artifact management, environment promotion strategies and policy enforcement
Security scanning tools including Snyk, GitHub (Advanced Security & Dependabot), Microsoft Solution Checker) and interpreting output into actionable backlog items
Threat modeling using STRIDE, PASTA stages (particularly Stages 4-7), MITRE ATT&CK and CAPEC referencing, and CWE mapping for defect classification.
Incident handling through triage logging, forensics, containment, credentials rotation, and post-incident retrospectives.
Additional requirements:
Strong scripting/automation in at least one: PowerShell, Python, or Bash.
Clear, concise written and verbal communication for executive summaries and technical deep dives.
Ability to prioritize remediation and negotiate risk-based exceptions with stakeholders.
Commitment to mentoring peers and elevating team security maturity.