Cloud CyberSecurity Engineer

AECOM is seeking a Cloud Security Engineer to join the Cybersecurity Engineering team and strengthen security outcomes across a global, multi-cloud environment. In this role, you will help define cloud control requirements, surface and quantify risk, and coordinate remediation activities with Infrastructure and Application teams across AWS, Microsoft Azure, and Microsoft 365.

This position focuses on enforcing approved cloud security baselines and standards while improving visibility, reporting, and configuration awareness. It also includes support for secure email operations and continuous enhancement of cloud security processes, tooling, and reporting.

Responsibilities

• Perform Cloud Security Posture Management (CSPM) to identify gaps and deviations.
• Use Palo Alto Prisma Cloud and Qualys TotalCloud to detect misconfigurations, vulnerabilities, and baseline deviations.
• Define remediation requirements for Infrastructure and Application teams, then initiate and drive those requirements toward closure.
• Partner with Security Architecture to translate cloud security standards into actionable control requirements.
• Ensure adherence to approved cloud security baselines and standards, including participation in exception management and risk acceptance processes with Cybersecurity Architecture and Cybersecurity GRC.
• Develop and deliver reporting on cloud security posture and risk to Cybersecurity and IT leadership.
• Own visibility into cloud security posture across AWS and Azure.
• Define risk metrics, prioritization models, and reporting standards for cloud security.
• Improve asset visibility and configuration awareness across cloud environments.
• Partner with Infrastructure and Application teams to support secure implementation of controls.
• Provide guidance on secure cloud practices aligned with enterprise standards including NIST and CIS.
• Collaborate with stakeholders to prioritize and address security risks.
• Support integration of cloud telemetry into enterprise logging and monitoring platforms.
• Enhance visibility into cloud activity and control effectiveness through continuous improvement of processes and tooling.
• Provide backup support for Proofpoint Email Gateway, including policy updates, tuning, and troubleshooting mail flow issues.
• Ensure continuity of secure email operations.
• Stay current with evolving cloud threats and technologies.

Requirements

• Bachelor’s degree (BA/BS) and at least 6 years of information technology and/or cybersecurity experience with a cloud security focus, or demonstrated equivalency of experience and/or education.
• Experience with AWS and Microsoft Azure environments.
• Experience with CSPM/CNAPP tools, such as Prisma Cloud, Qualys TotalCloud, CrowdStrike Cloud Security, or similar.
• Strong understanding of cloud security concepts, including IAM and network security.
• Experience managing and driving remediation of security issues.
• Strong communication and stakeholder management skills.
• Experience with Proofpoint Email Protection or similar platforms.
• Experience with SIEM and logging integrations.
• Familiarity with Infrastructure-as-Code concepts.
• Understanding of NIST, CIS, and ISO 27001.
• AWS and Azure cloud security certifications are highly preferred.
• Experience in large enterprise environments.

Technologies

• AWS
• Microsoft Azure
• Microsoft m365
• Palo Alto Prisma Cloud
• Qualys TotalCloud
• CrowdStrike Cloud Security
• Proofpoint Email Gateway
• Proofpoint Email Protection
• SIEM
• NIST
• CIS
• ISO 27001

Location: Dallas, TX (hybrid), with flexibility for a hybrid work schedule combining in-office and virtual work. Must be based in Dallas or Houston, TX.

Additional information: Relocation assistance is not available. Sponsorship for US work authorization is not available for this position, now or in the future.

Day 1 onboarding: All newly hired employees are required to attend an in-person Day 1 onboarding at an AECOM office location as a condition of employment.