Cloud Security Engineer

The mission of Washington Health Benefit Exchange (Exchange) is to radically improve how Washington residents secure health insurance through innovative and practical solutions, an easy-to-use customer experience, our values of integrity, respect, equity and transparency, and by providing undeniable value to the health care community.

The Exchange is a public-private partnership that operates Washington Healthplanfinder, the eligibility and enrollment portal used by one in four Washington residents to obtain health and dental coverage. Through this platform, and with support from a Customer Support Center and statewide network of in-person navigators and brokers, individuals and families can shop, compare and enroll in private, qualified health plans (as defined in the Affordable Care Act) or enroll in Washington Apple Health, the state Medicaid program.

The Exchange embraces the following equity statement adopted by our Board of Directors:

Equity is fundamental to the mission of the Washington Health Benefit Exchange. The process of advancing toward equity and becoming anti-racist is disruptive and demands vigilance to dismantle deeply entrenched systems of privilege and oppression. While systemic racism is a root cause of many societal inequities, we must also use an intersectional approach to address all forms of bias and oppression, which interact with and often exacerbate racial inequities. To be successful, we must recognize the socioeconomic drivers of health and focus on people and places where needs are greatest. As we listen to community, we must hold ourselves accountable to responding to recommendations to remedy inequitable policies, systems, or practices within the Exchange s area of influence. Our goal is that all Washingtonians have full and equal access to opportunities, power and resources to achieve their full potential.

SUMMARY

The Cloud Security Engineer position supports the Cloud & Infrastructure Security Team in the implementation and ongoing maintenance of information security solutions across both on-premises and cloud environments. The role focuses on providing expert guidance in cloud and infrastructure security architecture, with a strong emphasis on Microsoft Azure and cloud-native environments. Key responsibilities include enforcing security controls and configuration standards across cloud and on-premise systems, participating in design reviews, and collaborating with DevOps and Infrastructure teams to embed security best practices throughout the software development lifecycle. The position also involves evaluating emerging security technologies, maintaining comprehensive security architecture documentation, assessing the implementation of security controls, and managing vulnerability scanning processes to identify and mitigate potential risks.

DUTIES AND RESPONSIBILITIES
• Serve as a subject matter expert in cloud and infrastructure security, providing guidance on Microsoft Azure and cloud-native architectures.
• Enforce secure architectural requirements, security controls, and configuration standards for current and new cloud and on-premise infrastructure in accordance with WAHBE security policies and regulatory requirements (e.g., CMS, IRS).
• Perform cross-functional Cloud & Infrastructure security design reviews to ensure solutions align with established security policies.
• Collaborate with Infrastructure and DevOps teams to embed security best practices throughout infrastructure-as-code, CI/CD pipelines, and the software development lifecycle, implementing automated controls, threat modeling, and monitoring.
• Evaluate and recommend new and emerging security products and technologies.
• Create and maintain security architecture documentation, including models, baselines, templates, and diagrams.
• Assess the effectiveness of implemented security controls, identify any gaps, and provide progress updates.
• Configure, schedule, and conduct vulnerability scans using enterprise tools to identify potential security weaknesses.
• Analyze and prioritize vulnerabilities based on risk and potential impact to WAHBE.
• Assess identified findings from scan reports and develop actionable recommendations and compensating controls to address and mitigate associated risks.
• Collaborate with Infrastructure and Operations teams to develop and implement remediation plans.
• Ensure robust and measurable Vulnerability Management practices within both cloud and on-premise environments
• Report on vulnerability trends and key areas for improvement.
• Maintain and optimize security tools and technologies including but not limited to firewalls, endpoint protection, and SIEM.
• Continuously monitor the cloud and on-premise environment for security events, anomalies, and potential threats, and conduct thorough investigations to identify root causes and impacts.
• Perform technical incident response efforts, including investigation, containment, and recovery from security breaches, and preparation of incident reports.
• Collaborate with internal stakeholders, vendors, and external partners to ensure secure integration and ongoing compliance, maintaining synchronization with the Security objectives.
• Support Cloud and Infrastructure Security Lead to support audit activities by providing technical guidance and documentation, and act as a liaison for internal and external audit reviews as needed.
• Assist Cloud & Infrastructure Security Lead in reviewing existing security capabilities and assist in defining roadmap for cloud and infrastructure security enhancements.
• Support the development and implementation of information security awareness and training initiatives.
• Stay current on industry trends, emerging threats, and relevant technologies, and communicate key insights to the Cloud & Infrastructure Security Lead.
• Provide regular briefings to the Cloud and Infrastructure Security Lead and Information Security Manager (ISM), escalating issues and blockers as necessary.
• Perform other duties as assigned within the scope of cloud and infrastructure security.


QUALIFICATIONS

Required:
• Minimum of five (5) years of experience in information security.
• Experience in design and implementation of security tools, processes, and procedures
• Demonstrated experience in deploying and administering security controls within cloud and infrastructure environments.
• Demonstrated experience in cloud security principles and best practices for platforms such as Microsoft Azure, Amazon Web Services or Google Cloud Platform.
• Proficient in network security principles, firewalls, routers, switches, server administration and configuration baselines
• Experience with vulnerability management tools, such as Nessus, PrismaCloud.
• Demonstrated knowledge of secure SDLC, secure architecture design and security operations.
• Demonstrated experience in information security, data security, privacy, and or data management.
• Experience defining secure architectural requirements, security controls, and configuration standards in compliance with regulatory requirements.
• Experience with container security and securing container orchestration platforms.
• Experience with tools like Terraform and Ansible and familiarity with CI/CD pipelines for automated security testing and deployment.
• Demonstrated knowledge of common vulnerability assessment methodologies and techniques (e.g., CVSS scoring, threat modeling)
• Proven ability to prioritize identified vulnerabilities and work collaboratively with cross-functional teams to ensure timely remediation and risk mitigation.
• Demonstrates an understanding of the functions and operations of Security Information and Event Management (SIEM) systems, Endpoint Detection & Response.
• Expertise in threat detection, Incident Handling, and operational security.
• Demonstrates understanding of emerging cybersecurity threats.


Desired:
• Bachelor's degree in Engineering, Security or Technology related major, or closely allied field AND three to four years of related experience.
• Experienced in creating comprehensive reports and dashboards to communicate findings, track remediation progress, and provide visibility to management and relevant teams.
• Motivated self-starter with initiative to take independent action and accept responsibility for your actions.
• Demonstrated experience in supporting IRS/CMS or relevant audits.
• Demonstrates a proactive approach by consistently identifying potential blockers and communicating them early, while maintaining a solution-focused mindset to facilitate continued progress.
• Creative and proactive problem solver; must possess the ability to make independent decisions, set work priorities, and address issues promptly.
• Experience in developing, reviewing, and updating security standards, procedures, awareness and training.
• Demonstrates interpersonal and collaboration skills, effectively partnering with internal management, staff, and cross-functional teams as well as external partners and vendors.


APPLICATION INSTRUCTIONS

This position will be open until we find a suitable number of candidates to review. If interested, please submit an application as soon as possible. The Exchange reserves the right to close the recruitment at any time.


SALARY INFORMATION

Full Salary Range: $81,690.00 to $122,535.00 annually, with midpoint at $102,113.00.


Hiring Range: $93,944.00 and $102,113.00 annually. This is an estimate of where a qualified candidate can expect to receive an offer.


The actual salary offer will consider candidate experience, skills, qualifications, internal equity, and the market. Our compensation policy reserves the salary range above the midpoint for employees who are meeting and exceeding expectations and for growth and development, up to the maximum.


BENEFITS

Take a peek at our benefits package.


WORKING CONDITIONS

Core business hours are 8:00 a.m. to 5:00 p.m., Monday through Friday. There are times where irregular hours will be required. The preferred duty station is our Olympia, Washington headquarters. The nature of this role relies heavily on remote and in-person collaboration. While a hybrid remote and on-site schedule may be considered, the position will require flexibility to allow for in-office availability as business needs dictate. Travel requirements will be limited, however there may be occasions where an employee is required to travel and work irregular hours to attend meetings or trainings. Duties of this position require the use of standard office furniture and equipment, including setup for remote work. The employee is responsible for providing and maintaining a safe, ergonomic, and secure workspace at their remote location.


The working conditions and physical demands are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

SPECIAL REQUIREMENTS

A criminal background screen will be conducted for candidates under final consideration, and if hired, every five years of employment where highly sensitive data is processed or maintained by the position. The incumbent in this role will also be required to complete a federal fingerprint background check. The results of these background screens must meet the Exchange's eligibility standards.


OTHER INFORMATION

The above statements are intended to describe the general nature and levels of work being performed. They are not intended to be construed as an exhaustive list of responsibilities, duties and skills of personnel so classified.

This is not an employment agreement or contract. Management has the exclusive right to alter this job description at any time without notice.

The Washington Health Benefit Exchange is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, age, marital status, sex, sexual orientation, gender identity, national origin, disability or protected veteran status.

We participate in E-Verify. You can view the Department of Justice's Right to Work poster here.