Cloud CyberSecurity Engineer

AECOM is seeking a Cloud Security Engineer to join the Cybersecurity Engineering team and help enforce security outcomes across a global, multi-cloud environment. The role focuses on defining control expectations, identifying cloud risk, and partnering with Infrastructure and Application teams to drive remediation through to closure.

This position supports visibility and accountability for cloud security posture across AWS and Microsoft Azure, including Microsoft m365, while aligning efforts with enterprise security standards and governance processes.

Responsibilities

• Manage Cloud Security Posture Management (CSPM) to detect and address security issues.
• Use Palo Alto Prisma Cloud and Qualys TotalCloud to identify misconfigurations, vulnerabilities, and baseline deviations.
• Define remediation requirements and initiate remediation work with Infrastructure and Application teams.
• Track remediation progress and drive issues to closure.
• Partner with Security Architecture to translate cloud security standards into actionable control requirements.
• Ensure ongoing adherence to approved cloud security baselines and standards.
• Support exception management and risk acceptance processes with Cybersecurity Architecture and Cybersecurity GRC.
• Develop and deliver reporting on cloud security posture and risk to Cybersecurity and IT leadership.
• Own visibility into cloud security posture across AWS and Azure.
• Define risk metrics, prioritization models, and reporting standards.
• Improve asset visibility and configuration awareness across cloud environments.
• Partner with Infrastructure and Application teams to support secure control implementation.
• Provide guidance on secure cloud practices aligned with enterprise standards including NIST and CIS.
• Collaborate with stakeholders to prioritize and address security risks.
• Support integration of cloud telemetry into enterprise logging and monitoring platforms.
• Enhance visibility into cloud activity and control effectiveness.
• Provide backup support for Proofpoint Email Gateway.
• Assist with policy updates, tuning, and troubleshooting mail flow issues to ensure secure email operations continuity.
• Drive continuous improvement of cloud security processes, tooling, and reporting.
• Stay current with evolving cloud threats and technologies.

Requirements

• Bachelor’s degree (BA/BS) and at least 6 years of information technology and/or cybersecurity experience with a cloud security focus, or demonstrated equivalency of experience and/or education.
• Experience in AWS and Microsoft Azure environments.
• Experience with CSPM/CNAPP tools including Palo Alto Prisma Cloud, Qualys TotalCloud, CrowdStrike Cloud Security, or similar.
• Strong understanding of cloud security concepts, IAM, and network security.
• Experience managing and driving remediation of security issues.
• Strong communication and stakeholder management skills.
• Experience with Proofpoint Email Protection or similar platforms.
• Experience with SIEM/logging integrations.
• Familiarity with Infrastructure-as-Code concepts.
• Understanding of NIST, CIS, and ISO 27001.
• Cloud security certifications for AWS or Azure are highly preferred.
• Experience in large enterprise environments.

Technologies

• AWS
• Microsoft Azure
• Microsoft m365
• Palo Alto Prisma Cloud
• Qualys TotalCloud
• CrowdStrike Cloud Security
• Proofpoint Email Gateway
• Proofpoint Email Protection
• SIEM
• NIST
• CIS
• ISO 27001

Work Location and Schedule

• Location: Dallas, TX (hybrid)
• Hybrid work schedule combining in-office and virtual work, and must be based in Dallas or Houston, TX.
• Relocation assistance: not available.
• Work authorization sponsorship: not available for this position, now or in the future.
• Day 1 onboarding: all newly hired employees must attend an in-person Day 1 onboarding at an AECOM office location as a condition of employment.