Azure Cloud Security Engineer

LightFeather is seeking an Azure Cloud Security Engineer to help secure an enterprise Azure platform for a federal customer. You'll join a cloud security team that protects a shared Azure environment and guides the application teams who build on it. You'll recommend secure architectures, review configurations, and enforce tenant-wide security controls. The right person has strong security fundamentals, communicates clearly with customers, and enjoys learning new services quickly.

• Location: Hybrid—on-site 4 days per week in the Washington, DC metro area.
• Job Type: Full-time
• Salary: $120,000–$130,000 annually, based on experience level. 
• Clearance Requirement: U.S. citizenship is required for this position due to federal contract requirements and the need to obtain and maintain a Secret-level security clearance

Key Responsibilities

• Advise customer teams on secure architecture, service usage, access design, and workload deployment best practices.
• Review customer service configurations and proposed changes, and give clear recommendations and reference guidance.
• Explain landing zone templates and where shared responsibility falls once customers take over their environments.
• Secure the workloads and services the team deploys.
• Design and maintain tenant-wide governance controls, including Conditional Access, Azure Policy, and Microsoft Defender for Cloud regulatory compliance.
• Evaluate and apply new Microsoft security features and Zero Trust capabilities as the platform grows.
• Extend Zero Trust principles to emerging services such as Azure Databricks and AI workloads. That includes least privilege, mutual authentication, default-deny access, and tenant isolation.
• Support security operations with guidance on logging architecture, including audit, diagnostic, and traceable logs, and on reporting requirements.
• Automate security and management tasks with scripting.

Required Qualifications

• Active Secret clearance and the ability to obtain Top Secret.
• 3+ years of hands-on experience securing Microsoft Azure environments.
• Strong Azure infrastructure security fundamentals.
• Hands-on experience with Conditional Access, Azure Policy, and Defender for Cloud.
• Solid grasp of Zero Trust concepts: least privilege, shared responsibility, mutual authentication (mTLS), and the differences between tenancy, access, and continuous authentication.
• Excellent written and verbal communication, including direct, frequent work with customers over Microsoft Teams and other collaboration tools.
• Adaptability and a drive to pick up new technologies and responsibilities.

Preferred Qualifications

• Microsoft certifications: AZ-500 (strongly preferred), AZ-104, SC-300, SC-900, or SC-200
• Azure CLI and Microsoft Graph PowerShell.
• Terraform and Python.
• Working knowledge of NIST SP 800-53.
• Experience securing Azure Databricks or other data platforms.
• Exposure to AI model governance and security.
• Familiarity with SOC operations and logging requirements.