Senior Cloud Security Engineer

Ampcus Inc. is a certified global provider of a broad range of Technology and Business consulting services. We are in search of a highly motivated candidate to join our talented Team.

Job Title: Senior Cloud Security Engineer

Location(s): Warren, NJ

About the Role
We are seeking an experienced Senior Cloud Security Engineer to own cloud security remediation, hardening, and governance across the cloud environment.

This is a hands-on engineering role focused on implementing permanent security fixes, addressing recurring vulnerabilities, and ensuring security controls are enforced through automation and secure architecture.

The ideal candidate will have extensive Azure security experience, strong Microsoft Entra ID expertise, and a proven ability to translate security recommendations into sustainable engineering solutions.

Key Responsibilities
Security Remediation and Recurrence Prevention

• Own the complete lifecycle of security findings and recommendations, from triage and remediation through verification and closure.
• Address findings identified by security teams, Microsoft Defender for Cloud, and other security tools.
• Perform root-cause analysis of recurring security issues and implement permanent solutions.
• Develop policy-as-code, automated guardrails, and secure baselines to prevent recurring vulnerabilities.
• Track remediation SLAs and report on security risk reduction and cloud security posture improvements.

Identity and Authentication Security

• Secure and govern modern authentication protocols, including OIDC, OAuth 2.0 with PKCE, JWT validation, and mutual TLS (mTLS).
• Administer and harden Microsoft Entra ID, including application registrations, Enterprise Applications, permissions, consent governance, service principals, and managed identities.
• Implement credential and secret management practices and enforce least-privilege access.
• Design, implement, and continuously optimize Conditional Access policies.

Cloud Security Engineering and Governance

• Develop and enforce cloud security guardrails using Azure Policy and Terraform.
• Maintain secure-by-default Infrastructure-as-Code (IaC) baselines.
• Identify, monitor, and remediate cloud configuration drift.
• Manage Microsoft Defender for Cloud, improve secure scores, and remediate security recommendations.
• Support Cloud Security Posture Management (CSPM) initiatives.
• Contribute to security governance, including standards, control definitions, exception management, and audit evidence.

Administrative Portal and Privileged Access Security

• Secure cloud and SaaS administrative portals, including Azure, Microsoft 365, identity providers, and other cloud administration consoles.
• Enforce MFA and strengthen privileged access management.
• Implement Privileged Identity Management (PIM), just-in-time access, and role minimization.
• Establish and maintain secure break-glass access procedures.

AI Security

• Implement security controls for AI workloads, services, and AI agents.
• Secure agent and workload identities and enforce appropriate tool and permission scoping.
• Address data exposure, prompt injection, and emerging AI security risks.
• Apply security best practices to AI-enabled applications and agentic systems.

Required Qualifications

• 9+ years of experience in cloud security or security engineering, with extensive hands-on Microsoft Azure experience.
• Strong expertise in Microsoft Entra ID, including application registrations, Enterprise Applications, permissions, consent governance, and Conditional Access.
• Solid understanding of modern authentication protocols, including OIDC, OAuth 2.0/PKCE, JWT, and mTLS.
• Hands-on experience with Terraform and Azure Policy for policy-as-code and automated security guardrails.
• Experience with Microsoft Defender for Cloud and Cloud Security Posture Management (CSPM).
• Demonstrated experience identifying root causes and permanently resolving security findings rather than applying temporary fixes.
• Working knowledge of AI, AI agents, and AI security considerations.

Preferred Qualifications

• Experience with multi-cloud environments, including AWS and GCP.
• Relevant certifications such as Microsoft SC-100, AZ-500, SC-300, or CISSP.
• Experience with CI/CD pipeline security, secrets management, and SIEM/SOAR platforms.
• Scripting and automation experience using PowerShell and Python.
• Hands-on experience securing LLM-based applications or agentic systems in production.

Ampcus is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veterans or individuals with disabilities.