Cloud AI Security Engineer

Thales Defense & Security, Inc. (TDSI) Headquartered in Clarksburg, MD, is a U.S. company that has been serving domestic and international defense Air, Land and Sea domains for 60+ years. With over 1,000 employees, TDSI and its four subsidiaries (Advanced Acoustic Concepts, Digital Receiver Technology, Tampa Microwave, and Trusted Cyber Technologies), supports U.S. Joint Services, special operations forces and multi-national partners with a variety of communication, visualization, signal intelligence/electronic warfare, and sensor/sonar capabilities. TDSI’s key technologies include tactical handheld radios, expeditionary satellite terminals, helmet-mounted displays, optics and target recognition capability, advanced radars, undersea sensing and missile systems. Lives depend on what we do! 

Top Benefits (Subject to terms of applicable policies/plans) 

• Competitive Salary 


• Yearly Incentive Compensation Plan  


• Medical insurance for self and eligible family members 


• Generous 401(k) program- up to 7% company contribution and 100% immediate vesting 


• Tuition Reimbursement 


• Paid wellness, vacation, and holiday leave 


• Paid maternity, paternity, and parental leave 


• 9/80 Work Schedule (every other Friday off) 


• Hybrid working environment

We are seeking a hands-on Cloud Security Engineer with practical experience in Azure and/or AWS who can help build and operate core cloud security controls while integrating security into AI/ML workflows. This foundational role will partner across teams to deliver measurable improvements in identity, network segmentation, data protection, logging/monitoring, and compliance for DoD and government workloads. This role is located in our Clarksburg, MD office and will report to the Director of Cybersecurity. 

Responsibilities 

• Establish baseline cloud security controls (IAM/Entra ID, network segmentation, encryption, logging) with dashboards and runbooks.


• Deploy or tune CSPM/CWPP tooling; reduce misconfigurations and critical findings by agreed targets.


• Deliver audit-ready evidence for FedRAMP/CMMC/NIST SP 800-53 control families in scope.


• Stand up detections for cloud and AI-specific threats in Microsoft Sentinel or equivalent SIEM; document response playbooks.


• Design and operate security controls across Azure/AWS: IAM/Entra ID, VNet/VPC controls, NSGs/Security Groups, WAF, private endpoints/PrivateLink.


• Implement Zero Trust/least privilege patterns; establish guardrails. (Azure Policy, AWS SCPs, OPA/Gatekeeper).


• Deploy and maintain CSPM/CWPP tooling and integrate with SIEM (Microsoft Sentinel / Splunk).


• Protect AI/ML pipelines pragmatically: secure training data, model repos, and inference endpoints; apply access controls and logging.


• Conduct threat modeling and risk assessments; document findings with prioritized remediation plans and partner follow-through.


• Support compliance for FedRAMP, CMMC, NIST SP 800-53; produce artifacts and evidence for audits.


• Maintain runbooks, diagrams, and SOPs; drive continuous improvement through metrics.

Qualifications  

The requirements listed below are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.  

• U.S. Citizenship required. - Applicants selected may be subject to a government security investigation and must meet eligibility requirements for access to classified information. 


• Bachelor’s degree in a technical field or equivalent experience.


• 3 - 6 years in cybersecurity with 2+ years focused on Azure and/or AWS security in enterprise or government environments.


• Hands-on experience with IAM, network security, encryption, logging/monitoring, and CSPM/CWPP tools.


• Experience with infrastructure-as-code and policy-as-code; scripting for automation (PowerShell/Python/Bash).


• Working knowledge of compliance frameworks (FedRAMP, CMMC, NIST SP 800-53, DoD Cloud SRG).


• Strong communication and collaboration skills; ability to document and drive cross-team remediation.


• 
  
  Ability to participate in a rotating on‑call schedule to support continuous service and respond to priority issues as needed
  
  

Preferred

• Certifications: CISSP, CCSP, CISM, Azure Security Engineer, Security+.


• Experience integrating security into MLOps, LLMs, or generative AI applications.


• Container/Kubernetes security experience; service mesh and runtime protections.


• Experience with Azure Stack Edge family of devices.


• Experience with DoD networks, especially classified and operational networks.


• Understanding of enterprise networking concepts, especially Virtual Private Networks (VPNs), tunneling, QoS, and cloud connectivity solutions (e.g. Azure Express Route).

The annualized pay range for this role is $88,920.00 - $120,000.00 USD along with a target incentive compensation plan (ICP) of 5%. The pay range provided is a good faith estimate representative of the experience level for the role described above.  TDSI considers several factors when extending an offer, including but not limited to, the role, function and associated responsibilities, a candidate’s work experience, location, education/training, and key skills. 

For specific questions about this job posting, candidates may contact talent acquisition at [email protected]. 

Thales Defense & Security, Inc. is committed to non-discrimination as applicable under federal, state and local laws. We are an E-Verify Employer. 

If you need an accommodation or assistance in order to apply for a position with Thales Defense & Security, Inc., please call Human Resources at 240-864-7000.