Senior Cloud Governance Engineer

Kforce has a client in Charlotte, NC that is seeking a Senior Cloud Governance Engineer. Key Responsibilities: * Compliance & Audit Readiness: Own the end-to-end compliance lifecycle for cloud infrastructure; Ensure environments are continuously aligned with organizational policies, regulatory frameworks (SOC 2, ISO 27001, NIST, CIS Benchmarks), and internal standards * Policy-as-Code: Translate compliance requirements into enforceable Azure Policy definitions, Terraform validation rules, and automated guardrails that prevent non-compliant resources from being deployed * Evidence Collection & Automation: Design and implement automated workflows for collecting, organizing, and presenting audit evidence; Reduce manual effort during audit cycles by building repeatable, auditable processes * Terraform Pattern Governance: Review and provide guidance on infrastructure-as-code patterns to ensure they meet compliance, security, and operational standards; Propose required updates to existing Terraform modules when standards evolve * Security Posture Management: Operate and optimize cloud security posture management (CSPM) tooling, primarily Wiz, to identify misconfigurations, prioritize risk, and drive remediation with engineering teams * Monitoring & Reporting: Build and maintain compliance dashboards and workbooks using Azure Monitor and Azure Workbooks to provide real-time visibility into governance posture across subscriptions and environments * AI-Powered Governance Tooling: Design and build AI/LLM-driven tools that accelerate governance workflows - such as automated control mapping, natural-language policy interpretation, intelligent evidence summarization, and anomaly detection across compliance data * GRC Program Support: Maintain and operate governance, risk, and compliance (GRC) processes - including risk register management, control testing schedules, exception tracking, and remediation SLA monitoring * GRC Fundamentals: Strong grounding in governance, risk, and compliance, including control mapping, risk assessment, exception management, and remediation SLA tracking * IT Audit Experience: Hands-on experience with internal and external IT audits: scoping controls, assembling evidence, answering auditor questions, and driving findings to closure * Compliance Frameworks: Working knowledge of SOC 2, ISO 27001, NIST 800-53, and CIS Benchmarks, and the ability to read an internal standard and tell which technical requirement a control actually imposes * Azure Governance: Solid understanding of Azure Policy, management groups and policy inheritance, Microsoft Defender for Cloud, and Azure Monitor

• CSPM Tools (Wiz): Experience using Wiz or a comparable CSPM platform (Prisma Cloud, Orca) to investigate findings, judge their accuracy, and know where the tool's coverage stops
• Infrastructure as Code Literacy: Able to read Terraform well enough to understand what a

remediation changes and to write good acceptance criteria * AI-Assisted Workflows: Comfortable using AI-assisted tools and command-line workflows, working in Git, and critically checking AI-generated output before relying on it * Prioritization & Program Management: A record of running a backlog across several teams, making risk-based tradeoffs, and keeping work moving without direct authority * Communication & Influence: Able to turn technical findings into clear remediation guidance for engineers, precise questions for compliance, and a concise posture summary for leadership and auditors