Cloud AI Security Engineer

Thales Defense & Security Inc. (TDSI) Headquartered in Clarksburg MD is a U.S. company that has been serving domestic and international defense Air Land and Sea domains for 60 years. With over 1000 employees TDSI and its four subsidiaries (Advanced Acoustic Concepts Digital Receiver Technology Tampa Microwave and Trusted Cyber Technologies) supports U.S. Joint Services special operations forces and multi-national partners with a variety of communication visualization signal intelligence/electronic warfare and sensor/sonar capabilities. TDSIs key technologies include tactical handheld radios expeditionary satellite terminals helmet-mounted displays optics and target recognition capability advanced radars undersea sensing and missile dependon what we do!

Top Benefits (Subject to terms of applicable policies/plans)

• Competitive Salary
• Yearly Incentive Compensation Plan
• Medical insurance for self and eligible family members
• Generous 401(k) program- up to 7% company contribution and 100% immediate vesting
• Tuition Reimbursement
• Paid wellness vacation and holiday leave
• Paid maternity paternity and parental leave
• 9/80 Work Schedule (every other Friday off)
• Hybrid working environment

We are seeking a hands-on Cloud Security Engineer with practical experience in Azure and/or AWS who can help build and operate core cloud security controls while integrating security into AI/ML workflows. This foundational role will partner across teams to deliver measurable improvements in identity network segmentation data protection logging/monitoring and compliance for DoD and government workloads. This role is located in our Clarksburg MD office and will report to the Director of Cybersecurity.

Responsibilities

• Establish baseline cloud security controls (IAM/Entra ID network segmentation encryption logging) with dashboards and runbooks.
• Deploy or tune CSPM/CWPP tooling; reduce misconfigurations and critical findings by agreed targets.
• Deliver audit-ready evidence for FedRAMP/CMMC/NIST SP 800-53 control families in scope.
• Stand up detections for cloud and AI-specific threats in Microsoft Sentinel or equivalent SIEM; document response playbooks.
• Design and operate security controls across Azure/AWS: IAM/Entra ID VNet/VPC controls NSGs/Security Groups WAF private endpoints/PrivateLink.
• Implement Zero Trust/least privilege patterns; establish guardrails. (Azure Policy AWS SCPs OPA/Gatekeeper).
• Deploy and maintain CSPM/CWPP tooling and integrate with SIEM (Microsoft Sentinel / Splunk).
• Protect AI/ML pipelines pragmatically: secure training data model repos and inference endpoints; apply access controls and logging.
• Conduct threat modeling and risk assessments; document findings with prioritized remediation plans and partner follow-through.
• Support compliance for FedRAMP CMMC NIST SP 800-53; produce artifacts and evidence for audits.
• Maintain runbooks diagrams and SOPs; drive continuous improvement through metrics.

Qualifications

The requirements listed below are representative of the knowledge skill and/or ability required. Reasonableaccommodationsmay be made to enable individuals with disabilities to perform the essential functions.

• U.S. Citizenship required. - Applicants selected may be subject to a government security investigation and must meet eligibility requirements for access to classified information.
• Bachelors degree in a technical field or equivalent experience.
• 3 - 6 years in cybersecurity with 2 years focused on Azure and/or AWS security in enterprise or government environments.
• Hands-on experience with IAM network security encryption logging/monitoring and CSPM/CWPP tools.
• Experience with infrastructure-as-code and policy-as-code; scripting for automation (PowerShell/Python/Bash).
• Working knowledge of compliance frameworks (FedRAMP CMMC NIST SP 800-53 DoD Cloud SRG).
• Strong communication and collaboration skills; ability to document and drive cross-team remediation.

• Ability to participate in a rotating oncall schedule to support continuous service and respond to priority issues as needed

Preferred

• Certifications: CISSP CCSP CISM Azure Security Engineer Security.
• Experience integrating security into MLOps LLMs or generative AI applications.
• Container/Kubernetes security experience; service mesh and runtime protections.
• Experience with Azure Stack Edge family of devices.
• Experience with DoD networks especially classified and operational networks.
• Understanding of enterprise networking concepts especially Virtual Private Networks (VPNs) tunneling QoS and cloud connectivity solutions (e.g. Azure Express Route).

The annualized pay range for this role is $88920.00 - $120000.00 USD along with a target incentive compensation plan (ICP) of 5%. The pay range provided is a good faith estimate representative of the experience level for the role described above. TDSI considers several factors when extending an offer including but not limited to the role function and associated responsibilities a candidates work experience location education/training and key skills.

For specific questions about this job posting candidates may contacttalent acquisitionat

ThalesDefense & Security committed to non-discrimination as applicable under federal state and local laws. We are an E-Verify Employer.

If you need an accommodation or assistance in order to apply for a position with Thales Defense & Security Inc. please call Human Resources at .

Required Experience:

IC