Engineer, Application and Cloud Security - Archimedes

The Engineer, Security specializes in designing, implementing, and operating security controls for Azure and Microsoft cloud services. This role is responsible for protecting systems and applications that process, store, or transmit Protected Health Information (PHI), ensuring compliance with HIPAA Security Rule requirements through secure design, monitoring, and continuous risk management. This role focuses on reducing risk through secure architecture, security automation, and continuous monitoring across IaaS, PaaS, and identity workloads. The Engineer partners closely with Infrastructure, DevOps, and Software Engineering teams to embed security-by-design into platforms and delivery pipelines. This role also serves as the primary application security engineering function, partnering with Software Engineering and DevOps to identify, prevent, and remediate application-layer risks throughout the SDLC. This includes secure design reviews, threat modeling, CI/CD security controls, vulnerability remediation, and runtime protection of cloud-native applications. In addition, the Engineer, Security supports security operations by tuning detections, investigating alerts, and coordinating incident response using Microsoft Defender (including Defender for Cloud and Microsoft Defender XDR) and SIEM/SOAR capabilities such as Microsoft Sentinel. The Engineer helps protect internet-facing applications through Web Application Firewall (WAF) controls and Azure Front Door (AFD) security features, aligning protections to OWASP Top 10 risks. This position contributes to audit readiness and continuous compliance with regulatory standards (e.g., HIPAA, SOC 2, ISO 27001) through evidence collection, control validation, and policy-as-code practices. How do I make an impact on my team? Design and implement cloud security controls across Azure workloads (IaaS/PaaS), including network segmentation, Private Link/Private Endpoints, NSGs, Azure Firewall, and secure ingress/egress patterns. Design and validate security controls for applications and platforms that process Protected Health Information (PHI), including encryption, access controls, logging, and secure data flows. Support HIPAA and SOC 2 compliance by mapping technical controls to PHI risks, validating effectiveness, and producing audit‑ready evidence. Deploy, configure, and operationalize Microsoft Defender for Cloud (secure score, regulatory compliance, recommendations, JIT access) and integrate findings into remediation workflows. Serve as the primary Application Security (AppSec) engineer, partnering with Software Engineering to embed security controls across design, build, test, and runtime phases. Perform threat modeling and architecture reviews for new applications, major changes, and integrations (data flows, identity, APIs). Define and maintain application security requirements aligned to OWASP Top 10, API Security Top 10, and cloud-native threat models. Engineer detections and response workflows in Microsoft Sentinel (analytics rules, automation rules, playbooks), including KQL-based hunting and incident triage. Manage identity and access controls in Microsoft Entra ID, including RBAC, Conditional Access, MFA, Privileged Identity Management (PIM), and Managed Identities. Harden internet-facing applications using Azure Web Application Firewall (WAF) and Azure Front Door (AFD) policies, aligning protections to OWASP Top 10 and validating through testing and logging. Implement secure configuration baselines and policy-as-code using Azure Policy and Management Groups; define guardrails for encryption, logging, networking, and identity. Build and maintain security logging and telemetry (Azure Monitor, Log Analytics, Defender, AFD/WAF logs), ensuring required retention, diagnostics settings, and centralized visibility. Operate vulnerability management for cloud and application surfaces (e.g., Defender recommendations, scanning outputs), drive remediation prioritization, and validate fixes. Integrate application security tooling into CI/CD pipelines (SAST, SCA, secrets scanning, IaC scanning), ensuring actionable results without disrupting delivery. Triage and prioritize application vulnerabilities (code, dependencies, misconfigurations) based on risk, exploitability, and business impact. Partner with engineering teams to remediate findings and validate fixes. Secure secrets, keys, and certificates using Azure Key Vault, including access controls, rotation practices, and integration with applications and pipelines. Secure APIs and web services using authentication, authorization, rate limiting, and abuse protections. Validate WAF, AFD, and API gateway controls against application-specific threats, including bot abuse and injection attacks. Monitor runtime application telemetry for security signals and collaborate on incident response when application-layer issues are identified. Partner with engineering teams to embed secure SDLC practices threat modeling, security requirements, secure configuration, and remediation guidance for OWASP Top 10 classes. Review and improve Infrastructure-as-Code (Terraform/Bicep/ARM) for security and compliance, including least-privilege IAM, secure networking defaults, and drift detection. Investigate security events and participate in incident response, including containment/eradication, evidence collection, and post-incident root cause analysis and lessons learned. Oversee dependency and third-party library risk (SCA), including vulnerability tracking and remediation guidance. Define secure patterns for secrets management, service-to-service authentication, and external integrations. Support endpoint, identity, and cloud workload investigations using Microsoft Defender XDR and related telemetry; tune alerting to reduce noise and improve fidelity. Maintain runbooks, playbooks, and security documentation; contribute to change management and control evidence for audits and risk assessments. Conduct security reviews o