Security Engineer - Azure Government at SpaceXAI

On-site - Palo Alto, CA; Washington, D.C.

Apply
More jobs at SpaceXAI

SpaceXAI is a mission‑driven AI organization focused on creating systems that understand the universe. The Security Engineer – Azure Government role designs and maintains robust security controls across Azure Government and commercial environments, protects critical workloads, collaborates with engineering, DevOps, and compliance teams, and ensures compliance with federal regulations such as FedRAMP and CMMC.

Salary

USD 100,000 - 258,000

Requirements

Skills

  • Active U.S. security clearance (e.g., Secret, Top Secret) or eligibility to obtain one
  • 3+ years of experience in cloud security, cybersecurity engineering, or related roles (with strong Azure focus)
  • Deep hands‑on expertise with core Azure security services: Microsoft Defender suite, Sentinel, Intune, Entra ID, Key Vault, Azure Policy, Firewall, Network Watcher, and Purview
  • Strong understanding of DLP implementation both in cloud and on endpoints utilizing Purview and other Microsoft native controls
  • Experience implementing security in hybrid/multi‑cloud environments
  • Proficiency in scripting/automation (PowerShell, Azure CLI, Bicep/ARM templates, Terraform)
  • Strong understanding of identity federation, zero‑trust principles, encryption, network security, and vulnerability management
  • Familiarity with compliance frameworks (NIST, FedRAMP, CMMC, STIGs, etc.) and regulatory requirements
  • Excellent problem‑solving, analytical, and communication skills
  • Strong verbal and written communication skills and the ability to stay composed under pressure
  • Microsoft Certified: Azure Security Engineer Associate (AZ-500), Microsoft Cybersecurity Architect (SC-100)
  • Additional relevant certifications (e.g., CISSP, CCSP, Microsoft Certified: Azure Administrator, AWS Security Specialty, SANS GCPS, SANS GCAD)
  • Deep experience with detection and response engineering and SOC operations
  • Knowledge of container security (Docker, AKS), secure DevOps, or AI/ML workload protection
  • Prior experience in government regulations frameworks such as FedRAMP and CMMC

Responsibilities

  • Implement, design, and manage security architecture for Azure Government and Commercial deployments (with considerations for DoD IL5/IL6 and FedRAMP High controls)
  • Configure and optimize Microsoft Defender for Cloud, Microsoft Sentinel, Microsoft Defender for Endpoint, and related services for threat detection, vulnerability management, and automated response
  • Design and enforce identity & access management using Microsoft Entra ID, Privileged Identity Management (PIM), Conditional Access policies, RBAC, and just‑in‑time access
  • Secure network architectures with Azure Firewall, Network Security Groups (NSGs), DDoS Protection, Web Application Firewall (WAF), Network Watcher, and private endpoints
  • Protect data at rest and in transit via Azure Key Vault, encryption strategies, data classification, and information protection controls
  • Develop and maintain security policies, initiatives, and blueprints using Azure Policy and Microsoft Purview for compliance (NIST, FedRAMP, CMMC, STIGs, etc.)
  • Perform threat hunting, incident response, and forensics using Sentinel playbooks, Log Analytics, and KQL queries
  • Conduct security reviews of Infrastructure as Code (IaC), containers, Kubernetes (AKS), and serverless workloads
  • Collaborate with developers and architects to implement DevSecOps practices, including secure CI/CD pipelines, code scanning, and secure defaults
  • Monitor and remediate security findings, reduce attack surface, and improve overall security posture per the Microsoft Cloud Security Benchmark (MCSB)
  • Deploy configurations and compliance policies to Azure AVD endpoints using Intune and other Azure native services

Technologies

Azure GovernmentMicrosoft Defender suiteMicrosoft SentinelMicrosoft Defender for EndpointMicrosoft Entra IDPrivileged Identity Management (PIM)Conditional Access policiesRBACJust‑in‑time accessAzure FirewallNetwork Security Groups (NSGs)DDoS ProtectionWeb Application Firewall (WAF)Network WatcherPrivate endpointsAzure Key VaultEncryptionAzure PolicyMicrosoft PurviewSentinel playbooksLog AnalyticsKQL queriesInfrastructure as Code (IaC)ContainersKubernetes (AKS)Serverless workloadsDevSecOps practicesSecure CI/CD pipelinesCode scanningAzure AVDIntuneTerraformPowerShellAzure CLIBicep/ARM templates

Share job

See if your resume is ready for this job

See how our AI can optimize your resume and improve your chances for this role.