Cloud Security Engineer

TherapyNotes.com is hiring a hands-on Cloud Security Engineer to help secure cloud infrastructure, containerized workloads, and infrastructure-as-code pipelines, with an emphasis on Azure and healthcare-regulated compliance. This position also supports broader security engineering activities across the organization.

Location

Philadelphia, PA (onsite)

Compensation

USD 110,000 - 150,000 per year

Role Responsibilities

• Manage and secure cloud infrastructure and cloud-based applications, with a focus on Azure.
• Secure containerized workloads and Kubernetes environments (for example, AKS), including network policy, workload identity, runtime protection, and container image scanning.
• Own and mature cloud security posture management (CSPM), continuously identifying and remediating misconfigurations across cloud environments.
• Secure infrastructure-as-code (IaC) orchestration platforms, covering access control, secrets management, and deployment approval workflows for Terraform and OpenTofu pipelines.
• Manage and secure identities in Microsoft Entra ID using Conditional Access, Entitlement Management, and just-in-time (JIT) privileged access models.
• Review network diagrams and proposed connectivity changes, provide security input on segmentation and sensitive data flows, and partner with IT and SRE teams to address concerns.
• Administer Zero Trust network access and edge security tooling to secure access to corporate and cloud resources.
• Support broader security solutions, including SIEM, DLP, E/XDR, and vulnerability management.
• Monitor security alerts, respond to and escalate incidents, and participate in the incident response on-call rotation.
• Conduct threat analysis, vulnerability assessments, and risk evaluations; document findings, manage mitigation, and report status to leadership.
• Develop queries, scripts, integrations, and automated workflows to improve cloud security operations.
• Collaborate with development teams to ensure security is integrated into the SDLC and CI/CD pipeline.
• Perform periodic cloud configuration and access reviews to support compliance with security standards.
• Participate in audits and assessments, supporting governance, risk management, and compliance (GRC) efforts.

Requirements

• Bachelor’s degree in information security, computer science, or a related field preferred; equivalent experience considered.
• 5+ years of experience in cloud security engineering or a related role.
• Deep, hands-on experience securing cloud infrastructure and cloud-based applications (Azure preferred; AWS a plus).
• Hands-on network security experience and strong understanding of network architecture, connectivity, segmentation, and firewall controls.
• Experience securing containerized workloads and Kubernetes environments (for example, AKS), including network policy and workload identity, and runtime protection.
• Experience with cloud security posture management (CSPM) and remediating misconfigurations across cloud environments.
• Experience securing IaC orchestration platforms, including access control, secrets management, and deployment approval workflows (for example, Terraform, OpenTofu).
• Experience with Microsoft Entra ID, including Conditional Access, Entitlement Management, and JIT privileged access models.
• Experience with Zero Trust / SASE tooling (for example, Cloudflare Zero Trust, WAF, Gateway, or equivalent).
• Knowledge of security frameworks (NIST, ISO 27001, CIS) and compliance frameworks (HITRUST, PCI DSS).
• Proven ability to conduct security assessments, vulnerability management, and incident response.
• Strong understanding of OS platforms (Windows, Linux) and endpoint security.
• Industry certifications such as CISSP, SSCP, Security+, or a cloud security certification (Azure/AWS) preferred.

Technologies

Azure, AWS, Kubernetes, AKS, cloud security posture management (CSPM), Terraform, OpenTofu, Microsoft Entra ID, Conditional Access, Entitlement Management, just-in-time (JIT) privileged access models, Zero Trust / SASE, Cloudflare Zero Trust, WAF, Gateway, NIST, ISO 27001, CIS, HITRUST, PCI DSS, Windows, Linux, CISSP, SSCP, Security+, SIEM, DLP, E/XDR, GitOps tooling, Argo, Flux

Benefits

• Competitive salary: $110,000-$150,000
• Employer sponsored health, dental, vision, life, and disability insurance
• Retirement plan with company contribution
• Annual company profit sharing
• Personal development/training budget
• Open, collaborative work environment
• Extensive 2-week onboarding plan
• Comprehensive mentorship program

Additional Skills

• Familiarity with GitOps tooling (Argo, Flux) for secure deployment in Kubernetes environments.
• Network or Systems Engineering background is a huge plus.
• Familiarity with programming/scripting languages is a plus.
• Commitment to continuous learning and professional development.
• Ability to engage in new challenges and adapt quickly.
• Strong work ethic with a focus on ownership and project completion.
• Strong collaboration skills working with cross-functional teams.

Equal Opportunity Employer & Applicant Rights

• TherapyNotes LLC is an Equal Opportunity Employer and does not discriminate based on race, color, religion, sex, national origin, age, disability, genetic information, or any other protected status under federal, state, or local law.
• TherapyNotes LLC is committed to providing a workplace free of discrimination and harassment.
• If you require a reasonable accommodation during the application process, please contact [email protected].
• 10/6/2026