Cybersecurity Engineer (Cloud)

Purpose and scope

The Cloud Security Engineer implements and maintains security controls across commercial and government cloud environments, including Microsoft 365 Commercial and GCC High, Azure, AWS, hybrid-cloud services, and approved cloud-based artificial intelligence services. The role turns security architecture and regulatory requirements into working guardrails, configurations, automation, control evidence, and telemetry. Success requires hands-on cloud engineering and a working understanding of government, defense-industry, privacy, and international security frameworks. A central responsibility is implementing the controls needed to adopt generative AI, machine learning, enterprise copilots, and agentic systems safely across commercial, government, and CUI environments. The role also administers assigned cloud security platforms and supports risk assessment, control testing, remediation, and audit readiness. This role reports to the Senior Cybersecurity Architect & Senior Manager.

Essential responsibilities

Cloud security engineering

• Implement and maintain security controls across Microsoft 365 Commercial and GCC High, Azure, AWS, and hybrid services, including cloud guardrails, secure landing zones, workload protections, and virtual desktop environments.
• Configure and test security policies, infrastructure-as-code controls, deployment automation, and supporting integrations in coordination with cloud platform and application owners.
• Review technical findings, troubleshoot control failures, and recommend practical configuration changes that reduce risk without unnecessarily disrupting services.

Cloud security platform administration

• Administer assigned cloud security posture management and workload protection capabilities, including environment onboarding, policy configuration, security recommendations, coverage monitoring, and alert integrations.
• Maintain platform health and configuration, tune controls, document exceptions, and identify gaps in cloud coverage.
• Integrate cloud security telemetry with Security Operations and the managed security service provider. Support escalated investigations when cloud expertise is needed.
• Coordinate exposure prioritization and tracking with Vulnerability Management and work with cloud platform owners on remediation. The role does not own the underlying cloud services or their remediation queues.

Government cloud and compliance engineering

• Implement and validate technical controls that support CMMC and applicable NIST requirements, including NIST SP 800-171 and NIST SP 800-172.
• Support Microsoft 365 GCC High and CUI workloads with an understanding of government-cloud service limitations, tenant and security boundaries, data handling requirements, and controlled connectivity with commercial environments.
• Translate applicable requirements from DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, and other relevant frameworks into practical cloud configurations in coordination with Risk and Compliance.
• Perform technical risk assessments and control testing; maintain implementation records, evidence, exceptions, and remediation status for assessments and audits.

Artificial intelligence and agent security

• Implement and operate security controls for approved AI and machine-learning services, enterprise copilots, generative AI applications, retrieval-augmented generation, agents, and tool integrations.
• Configure identity and access controls, data-source permissions, secrets handling, execution boundaries, sandboxing, tool restrictions, human approval controls, network egress, logging, and other safeguards defined by Architecture.
• Test controls against risks such as prompt injection, indirect prompt injection, sensitive-data exposure, unsafe tool execution, over-privileged agents, unapproved model or service use, and manipulation of grounding content.
• Evaluate AI service configurations and new platform features for security, privacy, data residency, government-cloud availability, and CUI handling before implementation.
• Automate repeatable AI security configurations and validation checks through policy, scripting, infrastructure as code, and deployment pipelines where practical.
• Integrate relevant AI activity and security telemetry with enterprise monitoring and support investigations requiring AI expertise.

Collaboration and documentation

• Work with Identity, Network Security, Data Security, Detection and Incident Response, IT, connected program sites, and application teams to implement controls within their areas of responsibility.
• Maintain configuration standards, implementation guides, diagrams, operating procedures, and support documentation for assigned cloud security capabilities.
• Translate applicable security and regulatory requirements into technical configurations and provide evidence or technical input for assessments and audits when requested.
• Stay current on cloud and AI security threats and recommend improvements based on observed risk, platform changes, and operational experience.
• Participate in 2nd-level Security Operations Center (SOC) activities, e.g. respond to critical security incidents escalated by a MSSP. Provide off-hours support on an infrequent, but as needed basis.

Performs other duties as assigned.

Knowledge, Skills, & Abilities

• Working knowledge of cloud identity, network security, data protection, logging, posture management, and workload protection concepts.
• Working knowledge of generative AI and agentic-system security risks, including data exposure, prompt injection, tool and connector permissions, agent identities, secure execution, and audit logging.
• Ability to support technical risk assessments, control testing, remediation documentation, and audit evidence collection.
• Ability to troubleshoot technical issues, document work clearly, manage priorities, and collaborate with technical and non-technical partners.

Minimum qualifications

• U.S. citizenship is required for this position.
• Bachelor's degree in cybersecurity, information technology, computer science, engineering, or a related field, or an equivalent combination of education and relevant experience.
• Five years of related experience, to include three or more years of relevant experience in cloud, security, systems, or infrastructure engineering.
• Hands-on experience with Microsoft cloud or AWS security capabilities and the ability to support Microsoft 365, Azure, AWS, and hybrid services as needed.
• Experience implementing or maintaining technical controls through cloud policy, scripting, automation, or infrastructure as code.

Preferred qualifications

• Experience with a cloud security posture management, workload protection, or cloud-native application protection platform.
• Practical experience with, or demonstrated understanding of, Microsoft 365 GCC High or a comparable government cloud environment and the security boundaries associated with regulated data.
• Direct experience supporting government, defense-industrial-base, CUI, or other regulated cloud environments.
• Working knowledge of government and defense-industry security requirements, including CMMC, NIST SP 800-171 and NIST SP 800-172 concepts.
• Familiarity with DFARS, ITAR, ISO 27001, Australia DISP, UK Cyber Essentials Plus, GDPR, or comparable regulatory and international requirements.
• Hands-on experience securing cloud AI or machine-learning services, enterprise copilots, generative AI applications, retrieval-augmented generation, agents, or automated tool integrations.
• A relevant security or cloud certification, such as Security+, an Azure or AWS security certification, CCSP, or comparable training.

Work environment, physical demands and mental demands

Typical office environment with no unusual hazards, occasional lifting up to 50 pounds, constant sitting while using a computer terminal, constant use of sight while reviewing documents, constant use of speech and hearing for communication, constant mental alertness, and the ability to plan and organize work and meet deadlines. Other related cloud security duties may be assigned.

Compensation Details:

The compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities, education, experience, skills, internal equity, market data, applicable collective bargaining agreements, and relevant laws.

Benefits Overview:

Our health and welfare benefits are designed to support you and your priorities. Offerings include:

• Health, dental, and vision insurance

• Paid time off and holidays

• Retirement benefits (including 401(k) matching)

• Educational reimbursement

• Parental leave

• Employee stock purchase plan

• Tax-saving options

• Disability and life insurance

• Pet insurance

Note: Benefits may vary based on employment type, location, and applicable agreements. Positions governed by a Collective Bargaining Agreement (CBA), the McNamara-O'Hara Service Contract Act (SCA), or other employment contracts may include different provisions/benefits.

Original Posting:

Amentum anticipates this job requisition will remain open for at least three days, with a closing date no earlier than three days after the original posting. This timeline may change based on business needs.

Amentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race, sex, sexual orientation, pregnancy (including pregnancy, childbirth, breastfeeding, or medical conditions related to pregnancy, childbirth, or breastfeeding), age, ancestry, United States military or veteran status, color, religion, creed, marital or domestic partner status, medical condition, genetic information, national origin, citizenship status, low-income status, or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation, or any other protected category under federal, state, or local law. Learn more about your rights under Federal laws and supplemental language at Labor Laws Posters.

Welcome

Welcome back! We encourage you to check on the status of your current job applications with us. You can also search for a list of our current job openings and see if there are any new positions that might be a good fit for you. Thank you for continued interest in employment with Amentum.

About Us

For more than 100 years, Amentum has tackled the world’s toughest challenges to deliver agile and steadfast solutions to the U.S. government and its allies. With more than 50,000 employees on all seven continents and in more than 60 countries, Amentum delivers a broad range of operational support services to meet the critical needs of our clients. Our headquarters are in Chantilly, VA. Find us online at https://www.amentum.com/

If you need a reasonable accommodation for any part of the employment process, please complete our Accommodation Request. Requests for accommodation will be considered on a case-by-case basis.

If you need assistance, please reach out to workdaycandidateaccounts@amentum.com

Amentum is an EEO Employer

EEO including Disability/Protected Veterans

Labor Laws Posters

Recruiting Scam Advisory

Amentum has become aware of unauthorized individuals who are falsely using the Amentum name and /or logo in an attempt to solicit fees from potential job seekers. These deceptive and unauthorized individuals are soliciting money, promising placement in a position with Amentum. Please note any communication requesting any amount of money in exchange for employment with Amentum is fraudulent. These communications do not originate from Amentum and are not associated with the recruitment process.

Amentum and its affiliates never charge candidates fees or payments of any kind in order to secure employment. As a precaution, we recommend you do not disclose personal or financial details to anyone as a response to an unsolicited email, social media, or dating website request.

Amentum will never as ask for a placement fee or any other fee to expedite the hiring process. If you are contacted by anyone offering employment with Amentum, you should never be asked to pay a fee for recruiting. Amentum personnel will always send email from an identifiable corporate account (ending in @amentum.com) and never from a public email account like Yahoo!, Google, Gmail, or Hotmail. If you are contacted regarding a fraudulent employment proposal, we encourage you to alert your local law enforcement agency/police authority.

To read more about Amentum’s commitment to ethics, please click here.