Engineer, Application and Cloud Security - Archimedes

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes description of role, responsibilities, expectations, education, certifications, experience, skills & technologies, benefits. No explicit Pay or Schedule. So we should not include Pay or Schedule sections. Also we should not repeat job title as heading. Use

for each section heading. We need to preserve all substantive info, no boilerplate. Remove cookie/navigation/legal/EEO etc. The posting includes "How do I make an impact on my team?" which is essentially responsibilities list. Then "What our team expects from you?" includes education, certifications, experience, skills & technologies. Then "What can you expect from Archimedes?" includes benefits. We need to map to sections: About the role (maybe a brief summary), Responsibilities (list of duties), Requirements (maybe education/experience?), Qualifications (certifications?), Skills (skills & technologies), Benefits (benefits). We need to avoid filler. We must not invent content. Use only what's given. Let's extract: About the role: The first paragraph(s) describing role: "The Engineer, Security specializes in designing, implementing, and operating security controls for Azure and Microsoft cloud services. This role is responsible for protecting systems and applications that process, store, or transmit Protected Health Information (PHI), ensuring compliance with HIPAA Security Rule requirements through secure design, monitoring, and continuous risk management. This role focuses on reducing risk through secure architecture, security automation, and continuous monitoring across IaaS, PaaS, and identity workloads. The Engineer partners closely with Infrastructure, DevOps, and Software Engineering teams to embed security-by-design into platforms and delivery pipelines. This role also serves as the primary application security engineering function, partnering with Software Engineering and DevOps to identify, prevent, and remediate application-layer risks throughout the SDLC. This includes secure design reviews, threat modeling, CI/CD security controls, vulnerability remediation, and runtime protection of cloud-native applications. In addition, the Engineer, Security supports security operations by tuning detections, investigating alerts, and coordinating incident response using Microsoft Defender (including Defender for Cloud and Microsoft Defender XDR) and SIEM/SOAR capabilities such as Microsoft Sentinel. The Engineer helps protect internet-facing applications through Web Application Firewall (WAF) controls and Azure Front Door (AFD) security features, aligning protections to OWASP Top 10 risks. This position contributes to audit readiness and continuous compliance with regulatory standards (e.g., HIPAA, SOC 2, ISO 27001) through evidence collection, control validation, and policy-as-code practices." That's a good summary for About the role. Responsibilities: The list under "How do I make an impact on my team?" includes many bullet-like sentences. We need to put them in

• . Let's extract each line: - Design and implement cloud security controls across Azure workloads (IaaS/PaaS), including network segmentation, Private Link/Private Endpoints, NSGs, Azure Firewall, and secure ingress/egress patterns. - Design and validate security controls for applications and platforms that process Protected Health Information (PHI), including encryption, access controls, logging, and secure data flows. - Support HIPAA and SOC 2 compliance by mapping technical controls to PHI risks, validating effectiveness, and producing audit‑ready evidence. - Deploy, configure, and operationalize Microsoft Defender for Cloud (secure score, regulatory compliance, recommendations, JIT access) and integrate findings into remediation workflows. - Serve as the primary Application Security (AppSec) engineer, partnering with Software Engineering to embed security controls across design, build, test, and runtime phases. - Perform threat modeling and architecture reviews for new applications, major changes, and integrations (data flows, identity, APIs). - Define and maintain application security requirements aligned to OWASP Top 10, API Security Top 10, and cloud-native threat models. - Engineer detections and response workflows in Microsoft Sentinel (analytics rules, automation rules, playbooks), including KQL-based hunting and incident triage. - Manage identity and access controls in Microsoft Entra ID, including RBAC, Conditional Access, MFA, Privileged Identity Management (PIM), and Managed Identities. - Harden internet-facing applications using Azure Web Application Firewall (WAF) and Azure Front Door (AFD) policies, aligning protections to OWASP Top 10 and validating through testing and logging. - Implement secure configuration baselines and policy-as-code using Azure Policy and Management Groups; define guardrails for encryption, logging, networking, and identity. - Build and maintain security logging and telemetry (Azure Monitor, Log Analytics, Defender, AFD/WAF logs), ensuring required retention, diagnostics settings, and centralized visibility. - Operate vulnerability management for cloud and application surfaces (e.g., Defender recommendations, scanning outputs), drive remediation prioritization, and validate fixes. - Integrate application security tooling into CI/CD pipelines (SAST, SCA, secrets scanning, IaC scanning), ensuring actionable results without disrupting delivery. - Triage and prioritize application vulnerabilities (code, dependencies, misconfigurations) based on risk, exploitability, and business impact. - Partner with engineering teams to remediate findings and validate fixes. - Secure secrets, keys, and certificates using Azure Key Vault, including access controls, rotation practices, and integration with applications and pipelines. - Secure APIs and web services using authentication, authorization, rate limiting, and abuse protections. - Validate WAF, AFD, and API gateway controls against application-specific threats, including bot abuse and injection attacks. - Monitor runtime application telemetry for security signals and collaborate on incident response when application-layer issues are identified. - Partner with engineering teams to embed secure SDLC practices threat modeling, security requirements, secure configuration, and remediation guidance for OWASP Top 10 classes. - Review and improve Infrastructure-as-Code (Terraform/Bicep/ARM) for security and compliance, including least-privilege IAM, secure networking defaults, and drift detection. - Investigate security events and participate in incident response, including containment/eradication, evidence collection, and post-incident root cause analysis and lessons learned. - Oversee dependency and third-party library risk (SCA), including vulnerability tracking and remediation guidance. - Define secure patterns for secrets management, service-to-service authentication, and external integrations. - Support endpoint, identity, and cloud workload investigations using Microsoft Defender XDR and related telemetry; tune alerting to reduce noise and improve fidelity. - Maintain runbooks, playbooks, and security documentation; contribute to change management and control evidence for audits and risk assessments. - Conduct security reviews of cloud architecture and changes (new services, networking, identity, data flows), providing actionable recommendations and risk-based exceptions when needed. - Participate in, adhere to and support compliance and diversity, equity, and inclusion program objectives. - Other duties as assigned. We should keep all. Requirements: maybe education and experience? The "What our team expects from you?" includes Education, Certification/Licenses, Experience, Skills & Technologies. We could split: Requirements (Education + Experience), Qualifications (Certifications), Skills (Skills & Technologies). But we need to avoid thin sections. Let's see. Education: Bachelor’s degree or equivalent work experience required. Certification/Licenses: Microsoft security certifications such as Azure Security Engineer Associate (AZ-500) preferred; additional certifications such as SC-200 (Security Operations Analyst), SC-100 (Cybersecurity Architect), or equivalent security certifications preferred. Experience: 5+ years of experience in cloud security, security engineering, security operations, or cloud infrastructure roles with significant security responsibilities (Azure preferred). Then many bullet points of experience. We could combine Education and Experience into Requirements. Certifications into Qualifications. Skills & Technologies into Skills. But we need to ensure we don't create sections with filler like "not specified". All have content. Let's extract Requirements (Education + Experience). We'll list education and experience items as
  • . Might be long but okay. Experience list includes many bullet points after "Experience5+ years of experience..." Actually the text: "Experience5+ years of experience in cloud security, security engineering, security operations, or cloud infrastructure roles with significant security responsibilities (Azure preferred).Hands-on experience with Microsoft Defender (Defender for Cloud and/or Microsoft Defender XDR) and translating security findings into prioritized remediation.Experience with Microsoft Sentinel (or equivalent SIEM), including KQL queries, detection engineering, alert triage, and incident investigation.Strong understanding of Azure networking and security controls, including secure ingress/egress, firewalling, Private Link, and DNS considerations.Experience protecting web applications using WAF capabilities (Azure WAF/Application Gateway and/or Azure Front Door), including rule tuning and monitoring aligned to OWASP Top 10.Hands-on experience with application security practices, including threat modeling, secure design reviews, and remediation of OWASP Top 10 vulnerabilities.Experience integrating security controls into CI/CD pipelines (SAST, SCA, secrets scanning, IaC scanning).Understanding of API security, authentication/authorization patterns, and common web application attack techniques.Experience partnering with software engineers to drive secure coding practices and risk-based remediation.Solid grasp of identity and access management (Entra ID), RBAC, least privilege, Key Vault, and platform security controls required.Experience implementing governance guardrails using Azure Policy, Management Groups, and security baselines (e.g., Azure Security Benchmark) required.Experience reviewing and securing Infrastructure as Code (Terraform/Bicep/ARM), including secure defaults, secret handling, and drift detection preferred.Familiarity with DevSecOps practices (security scanning, policy enforcement, and automated evidence collection) integrated into CI/CD pipelines preferred.Experience with incident response processes, alert investigation, and post-incident reviews (RCA/lessons learned) preferred." We need to split into separate list items. Qualifications: Certifications/Licenses. Skills: Skills & Technologies list. Benefits: "What can you expect from Archimedes? Top of the industry benefits for Health, Dental, and Vision insurance 20 days paid time off 4 weeks paid parental leave 9 paid holidays 401K company match of up to 5% - No vesting requirement Adoption Assistance Program Flexible Spending Account Educational Assistance Plan and Professional Membership assistance" We need to format as list. Now produce HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits. No Pay or Schedule. Make sure to use

    for each heading, then content: either

    for prose or

    • for lists. For About the role, we can use

      containing the paragraph(s). Could be multiple paragraphs but we can combine into one

      with line breaks? Better to keep as

      with the whole description. For Responsibilities:

      • each bullet. For Requirements: we need to include Education and Experience. Could be two
        under same heading? Or we can make separate
        for education and experience. Simpler: make a
        with items: Education: Bachelor’s degree or equivalent work experience required. Then each experience bullet as separate
        • . Might be long but okay. Qualifications:
          with certifications. Skills:
          with each skill/technology item. Benefits:
          with each benefit. Let's extract skills list: The "Skills & Technologies" section includes categories with items separated by commas. We need to break into individual items? The instruction: Use
          • for any list of duties/requirements/benefits. So we should list each distinct skill/technology as separate
          • . The text: "Compute & Platform Azure VMs, App Services, AKS, Azure Functions, Virtual DesktopInfrastructure as Code Terraform, Bicep, ARM, Azure CLI, PowerShellNetworking VNets, NSGs, UDRs, Azure Firewall, VPN Gateway, ExpressRoute, App Gateway, Front Door, Private LinkWeb & Edge Security Azure W