Senior Azure Cloud Security Architect - CNAPP

At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. EY Infosec is seeking a Cloud Security consultant with expertise in cloud security architecture, configuration, and governance across the Microsoft Azure platform with subject matter expertise on Cloud Native Application Protection Platform (CNAPP) technology and its integration into development, release, and operational practices. This is a hands-on role to guide, implement and maintain the security of cloud services and infrastructure. The consultant will lead the enablement of CNAPP technology and apply best practices for secure deployments to proactively identify and mitigate security risks for EY’s business applications hosted in the Azure environment. The ideal candidate will also have familiarity with other cloud platforms such as GCP and AWS. Role summary This position is a Business security consultant to drive the full lifecycle enablment of the Wiz CNAPP platform across a large and growing portfolio of applications hosted in Azure, as well as at the Azure infrastructure level. The consultant will work within a DevSecOps model and enable automated security testing and compliance, vulnerability management, and overall risk reduction in the environment. The ideal candidate will have to think outside the box to solve unique security issues that arise and adopt new cloud services. The role will also provide advice to the project teams in designing, developing and implementing all aspects of security for complex global applications based on Microsoft Azure technology and generally the Microsoft technology stack. The role is very much an individual contributor capable of supporting multiple project teams. In other words, it is not a program management or oversight role, but one that requires collaboration with product owners, architects, developers, DevOps, and other information security roles in the design, implementation and certification of security controls across multiple projects/applications. This also requires knowledge of various IT system architectures and Cloud technology, as well as supporting technologies such as SAST tools, DAST tools, Identity and Access Management (IAM), network security, firewalls, audit and logging, and other security concepts as outlined in ISO27001, OWASP and related security standards. The consultant should have knowledge of 3rd Party security assessments and applicability of SOC1 and SOC2 reports and concepts of vendor risk management. Key responsibilities SME (subject matter expert) to mature/advance our cloud security posture using the Wiz CNAPP across the Azure cloud platform. Guide and help Integrating Wiz to drive risk-based remediation with product/DevOps teams and automate guardrails that keep our environment compliant and resilient. ‑based remediation with product/DevOps teams and automate guardrails that keep our environment compliant and resilient. Drive the implementation of existing and new features of Wiz and build the capabilities of CNAPP within EY. Develop, tune, and enforce security policies, requirements, standards, and procedures for cloud environments and containerized workloads, including Kubernetes clusters setup, and orchestration solutions, emphasizing vulnerability reduction and compliance. Collaborate with cross-functional teams to shift left (IaC scanning in CI/CD, approve/deny policies), integrate security best practices into the software development lifecycle (SDLC) and continuous integration/continuous deployment (CI/CD) pipelines. ‑left Develop and implement security automation solutions to continuously monitor cloud environments for compliance, threats, and performance anomalies. Automate ingestion of security defects and vulnerability findings to Jira/ServiceNow Conduct regular security assessments, vulnerability scans, and threat modeling for cloud environments. Identify, evaluate, and mitigate risks in cloud infrastructure using automated/customized methods. Work with cross-functional teams, including security architects, engineers, developers and product owners to explore new ideas and develop innovative ways to automate, monitor, and improve security at scale across cloud platforms. Work with Security Ops and Incident response teams to investigate and remediate security incidents, providing expertise on cloud-specific attack vectors and mitigation strategies. Generate dashboards and executive metrics (risk reduction, SLA adherence, coverage) for assigned portfolio of business products and services. Report related security risks, incidents, and findings to leadership and relevant stakeholders. Collaborate with stakeholders to define project scope, deliverables, and expectations, ensuring alignment with business objectives. Identify gaps in existing security tools and services, and, when necessary, collaborate with development teams to create custom security solutions to protect the organization. Qualifications Bachelor’s degree in Computer science, Information Security, or related field 8+years of experience working as a Cloud Security Engineer/Architect with Wiz (or similar CNAPP platforms and capabilities) Hands-on experience with Wiz (or similar CNAPP) capabilities at Enterprise level including – CSPM, CWPP, Vulnerability scanning, Compliance assessments, DevSecOps integration CI/CD familiarity (GitHub/GitLab/Azure DevOps), IaC (Terraform/CloudFormation) Scripting/automation (Rego/Python/TypeScript), APIs/webhooks, event pipelines Strong understanding of DevSecOps principles and practices. Must possess excellent communication, presentation, and collaboration skills. Relevant security certifications such as CISSP or GIAC certs or Azure Security Engineer is a plus Frameworks: CIS Benchmarks, NIST 800‑53, 800‑190, ISO 27001/27002, SOC 2 and other industry standards Bonus: data classification (GDPR/CCPA), Container/Kubernetes security (EKS/AKS) What we offer you The compensation ranges below are provided in order to comply with United States pay transparency laws. Other geographies will follow their local salary guidelines, which may not be a direct conversion of published US salary ranges. At EY, we’ll develop you with future-focused skills and equip you with world-class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams. Learn more . We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job in all geographic locations in the US is $128,100 to $239,600. The base salary range for New York City Metro Area, Washington State and California (excluding Sacramento) is $153,800 to $272,300. Individual salaries within those ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options. Join us in our team-led and leader-enabled hybrid model. Our expectation is for most people in external, client serving roles to work together in person 40-60% of the time over the course of an engagement, project or year. Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being. Are you ready to shape your future with confidence? Apply today. EY accepts applications for this position on an on-going basis. For those living in California, please click here for additional information. EY focuses on high-ethical standards and integrity among its employees and expects all candidates to demonstrate these qualities. EY | Building a better working world EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets. Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow. EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories. EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law. EY is committed to providing reasonable accommodation to qualified individuals with disabilities including veterans with disabilities. If you have a disability and either need assistance applying online or need to request an accommodation during any part of the application process, please call 1-800-EY-HELP3, select Option 2 for candidate related inquiries, then select Option 1 for candidate queries and finally select Option 2 for candidates with an inquiry which will route you to EY’s Talent Shared Services Team (TSS) or email the TSS at View email address on click.appcast.io . #J-18808-Ljbffr