Senior Cloud Cyber Security Engineer - Remote - Remote Eligible

Senior Cloud Cyber Security Engineer - Remote

Sentara Health is seeking to hire a qualified individual to join our team as a Senior Cloud Cyber Security Engineer - Remote.

Job Description

Cloud Security Architecture and Design:

• Design and implement secure cloud architectures, ensuring adherence to best practices and compliance requirements.
• Collaborate with cloud architects and DevOps teams to integrate security controls and mechanisms into cloud environments.
• Review and assess cloud infrastructure and service configurations to identify potential security risks and recommend necessary improvements.

Cloud Security Assessments:

• Conduct regular security assessments, including vulnerability scanning, penetration testing, and security audits of cloud resources and services.
• Identify and prioritize security vulnerabilities, misconfigurations, and compliance gaps, and provide recommendations for remediation.
• Assist in implementing and maintaining security testing tools and automation scripts for continuous security assessment.

Identity and Access Management:

• Develop and implement cloud-specific identity and access management (IAM) policies and controls to ensure appropriate access rights and permissions.
• Monitor and review IAM configurations, roles, and access policies to prevent unauthorized access and privilege escalation.
• Collaborate with identity teams to integrate cloud IAM with enterprise identity and access management systems.

Cloud Security Monitoring and Incident Response:

• Implement and manage cloud security monitoring tools and solutions to detect and respond to security incidents in real-time.
• Establish incident response plans and processes specific to cloud environments, collaborating with incident response teams to investigate and mitigate cloud-related security incidents.
• Conduct post-incident analysis and implement measures to prevent similar incidents in the future.

Compliance and Governance:

• Ensure cloud infrastructure and services comply with relevant security standards, regulations, and industry frameworks (e.g., CIS, NIST, GDPR, etc.).
• Participate in security audits, assessments, and regulatory compliance activities, working with auditors to address findings and ensure compliance.
• Stay updated with evolving cloud security trends, emerging threats, and regulatory changes, and provide guidance on implementing necessary controls.

Cloud Security Education and Awareness:

• Work with Governance team to conduct training and awareness programs for cloud users, developers, and stakeholders to promote secure cloud practices and awareness of cloud-specific security risks.
• Provide guidance and recommendations on secure cloud architecture, configurations, and deployment practices to development and operations teams.

Desired Characteristics

• Strong analytical skills – strong problem-solving skills, communicates in a clear and succinct manner and effectively evaluates information/data to make decisions; anticipates obstacles and develops plans to resolve.
• Change oriented – actively generates process improvements; supports and drives change and confronts difficult circumstances in creative ways. Self-motivated, self-directed, flexible, and able to work under pressure and in fast paced team environment.
• Strong functional team player with experience working seamlessly across a matrix structure.
• Excellent interpersonal, written/verbal communication and leadership skills with the ability to make recommendations to all levels of the organization.

Requirements

• Proven experience (5 years) in cloud security roles, with a strong understanding of cloud platforms and services (AWS, Azure, or GCP).
• Deep knowledge of cloud security best practices, cloud-native security tools, and cloud service provider security offerings.
• Experience with cloud security assessment tools, vulnerability scanning, and penetration testing techniques.
• Familiarity with cloud identity and access management (IAM) concepts and frameworks.
• Understanding of networking, encryption, and virtualization technologies as they relate to cloud security.
• Excellent analytical and problem-solving skills, with the ability to effectively assess and communicate cloud security risks.
• Strong written and verbal communication skills, with the ability to collaborate with cross-functional teams and provide security guidance.
• Cloud security controls: Identity and Access Management (IAM), Encryption, Network Security, Compliance, Logging and Monitoring, Vulnerability Management, Disaster Recovery and Business Continuity, Cloud Access Security Broker (CASB), and Multi-Factor Authentication (MFA).
• Knowledge of various technical frameworks and concepts(MITRE ATT&CK, CIS, Kill Chain, etc)
• Experience working in a highly regulated environment.
• Ability to express complex technical concepts in business terms.
• Organized and detail-oriented, able to work well under deadlines in a changing environment and complete multiple projects effectively and concurrently.
• Evaluate effectiveness of the internal security control framework and recommend adjustments as business needs change.
• Regularly interact with all levels of management to present and discuss control effectiveness.
• Review and coordinate changes to cyber security policies, procedures, and standards.

Education

• Bachelors Degree + 5 years relevant experience may be accepted in lieu of degree
• No Degree + 7 years of relevant experience without a degree

Certification/Licensure

• No specific certification or licensure requirements

Experience

• Required to have cloud cyber security experience