Azure 安全工程师 - 远程（美国任何地方）

GuidePoint Security provides trusted cybersecurity expertise, solutions and services that help organizations make better decisions and minimize risk. By taking a three-tiered, holistic approach for evaluating security posture and ecosystems, GuidePoint enables some of the nation’s top organizations, such as Fortune 500 companies and U.S. government agencies, to identify threats, optimize resources and integrate best-fit solutions that mitigate risk.

General Description

We are looking for a skilled Azure Security Engineer to support our GuidePoint Microsoft Cloud Security Practice. This role will engage in the development of customer facing Azure security engineering services while providing “Wow Them” service to clients and/or internal customers or co-workers.

The Azure Security Engineer is responsible for designing, implementing, and securing our customers Azure infrastructure. Azure Security Engineers operate primarily in a remote customer facing role with a focus on integrating cloud security technologies into either an existing or new environment while providing expertise in cloud computing to drive business efficiency and innovation. Azure Security Engineers evaluate existing cloud infrastructure and provide recommendations and or implement improvements to strengthen the cloud security posture of the environment. Azure Security Engineers demonstrate strong working knowledge across Azure Commercial and Azure Gov Cloud tenants, subscription management, landing zones, networking, security, and infrastructure through implementation of Microsoft Azure best practices and infrastructure as code (IaC). Azure Security Engineers work with cloud infrastructure team members as needed to provide secure configurations within the Microsoft Azure infrastructure. As a subject matter expert (SME), the Azure Security Engineer also brings deep, hands-on expertise across the broader Azure platform—including AI platform engineering with Azure AI Foundry and enterprise API management and governance with Azure API Management (APIM)—and serves as the technical authority for architecting, securing, and operationalizing these workloads for customers.

About the Cloud Practice

The Cloud Practice is responsible for providing advisory services as well as secure implementations specific to security tooling with the intent of protecting the customers' identities, endpoints, data, applications, and cloud infrastructure by designing, deploying, and operationalizing Cloud Solution Providers native security solutions. We focus specifically on ensuring cloud security, data security, identity and access management, as well as threat protection has been implemented following best practices across the organization.

Our team of Microsoft specialists focus on deploying Microsoft security, compliance, and identity solutions to protect identities, devices, data, apps, and infrastructure. We partner with other internal Teams and resources to ensure the overall goals of the clients are achieved and align with industry standards and best practices.

Roles and Responsibilities:

• Design Azure cloud solutions with a secure-by-design approach

• Collaborate with customer IT teams to implement and secure cloud resources, implement configurations based on security policies, standards, and best practices

• Develop and implement scalable and resilient cloud architecture solutions within Azure Commercial or Azure Gov Cloud environments

• Develop and implement migration strategies for local on premises hosted environments to Azure cloud tenants

• Work with customers to secure Microsoft Entra ID

• Create and implement migration plans for each Azure infrastructure service, system, and/or application that will be deployed to Azure as part of a migration project

• Create architectural and data flow diagrams for Azure environments

• Develop and deploy infrastructure as code (IaC) using tools like Terraform, Azure Resource Manager (ARM) templates, Bicep, and PowerShell

• Ensure systems, applications, and data meet high availability design principles and/or are replicated to meet organizational requirements for disaster and business recovery

• Analyze and ensure that proper monitoring and alerting systems are in place for systems, services, and applications in customer Azure environments

• Evaluate and recommend Azure services based on business requirements and industry best practices

• Collaborate with software developers, system administrators, and other stakeholders to integrate Azure solutions into either new or existing systems and applications

• Ensure seamless interoperability between on-premises and cloud environments

• Implement and enforce security requirements to protect Azure-based systems and data

• Serve as the subject matter expert (SME) for Azure AI Foundry, architecting, deploying, and securing generative AI and machine learning workloads, including model catalog selection, model deployments, AI agents, and prompt flow orchestration

• Design and implement enterprise-grade Retrieval-Augmented Generation (RAG) and grounding solutions using Azure AI Foundry, Azure AI Search, and integrated customer data sources

• Establish Responsible AI, content safety, evaluation, and guardrail practices for AI workloads to ensure alignment with governance, data protection, and regulatory requirements

• Secure Azure AI Foundry workloads through network isolation (private endpoints), managed identities, customer-managed keys, and least-privilege access controls

• Serve as the subject matter expert (SME) for Azure API Management (APIM), designing and operating secure, scalable API gateways, products, versions, and revisions across Azure Commercial and Azure Gov Cloud environments

• Author and manage APIM policies for authentication and authorization (OAuth 2.0, JWT validation, mutual TLS), rate limiting, caching, request/response transformation, and backend routing

• Design and implement APIM as a GenAI gateway in front of Azure AI Foundry and Azure OpenAI endpoints, including token-based rate limiting, semantic caching, load balancing across model deployments, and centralized monitoring of AI consumption

• Integrate APIM with Microsoft Entra ID, Application Gateway / Web Application Firewall (WAF), private networking, and self-hosted gateways to enforce Zero Trust and secure hybrid connectivity

• Establish API governance, lifecycle management, developer portal experiences, and end-to-end observability (logging, metrics, and diagnostics) for customer API estates

• Define and maintain Azure Governance policies including Subscription Management, Cost Management, Security, Resource Consistency, Identity Baseline, Deployment Acceleration, etc.

• Ensure compliance of architectural and engineering policies, standards, and procedures

• Stays current with emerging cloud technologies and trends and advise on the adoption of new Azure features and services

• Works closely with development teams to support DevOps practices and implement continuous integration and continuous deployment (CI/CD) pipelines

• Leads technical discussions and presentations for internal teams as well as customers

• Recommends strategies to streamline Azure native technologies for effectiveness and efficiency, considering client needs.

• Consistently produce work product in conformance with GuidePoint Security standards

• Approaches problem solving collectively with senior staff and internal and external clients to achieve a mutually beneficial result

• Participates in the development of the Microsoft Cloud team’s strategic plans, training materials and tools

• Effectively trains and mentors staff on new and emerging Azure specific technologies

• Demonstrate ability to author professional documentation that serve as customer deliverables and internal standard operating procedures and delivery playbooks

• Performs other duties and responsibilities as required

Required Experience and Education:

• Bachelor’s Degree and 5 years of experience building or managing cloud environments in medium to large companies

• Professional certification in Azure, such as Azure Solutions Architect Expert or similar preferred

• Strong understanding of cloud computing technologies, business drivers, and emerging computing trends

• Proficient in Azure services, including but not limited to Entra ID, Azure Virtual Networks / Machines, Azure App Services, Azure Kubernetes Service, Azure Key Vault, Azure Private Link/Private Endpoint

• Subject matter expert (SME)–level proficiency in Azure AI Foundry, including model catalog and model deployment, AI agents, prompt flow, Retrieval-Augmented Generation (RAG) architectures, evaluations, and Responsible AI / content safety controls

• Subject matter expert (SME)–level proficiency in Azure API Management (APIM), including gateway architecture, policy authoring, API security and versioning, developer portal, self-hosted gateways, and use of APIM as a GenAI / AI gateway (token limiting, semantic caching, and load balancing) in front of Azure AI Foundry and Azure OpenAI endpoints

• Experience with Azure OpenAI and generative AI solution patterns, including prompt engineering, embeddings, and vector / semantic search (e.g., Azure AI Search)

• Hands-on experience with containerization and orchestration using Azure Kubernetes Service (AKS), Azure Container Registry (ACR), and Azure Container Apps

• Working knowledge of Azure observability and operations tooling, including Azure Monitor, Log Analytics, Application Insights, and Microsoft Defender for Cloud

• Familiarity with the Azure Well-Architected Framework and Cloud Adoption Framework (CAF) landing zones

• Proficiency with scripting and automation using PowerShell, Azure CLI, and at least one general-purpose language such as Python for AI and API integration

• Experience designing Zero Trust architectures and implementing security controls for AI and API workloads

• Experience with FinOps and Azure cost management practices, including governance of AI token consumption and API usage costs

• Relevant certifications such as Azure AI Engineer Associate (AI-102), Azure Security Engineer Associate (AZ-500), or Azure Network Engineer Associate (AZ-700) are a plus

• Must pass either the Cloud Security Alliance Certificate of Cloud Security Knowledge (CCSK) or the (ISC)2 Certified Cloud Security Professional within 6 months of joining the team.

• Experience with cloud security, networking, and disaster recovery best practices

• Strong knowledge of infrastructure as code (IaC) tools such as Azure Resource Manager (ARM) templates or Terraform

• Experience with network security best practices and configurations

• Strong troubleshooting skills and attention to detail

• Strong written and verbal communication skills

• Ability to solve technical, managerial, or operational problems and evaluate options based on relevant information, resources, well-rounded experience, and knowledge

• Demonstrated ability to communicate clearly and concisely, both orally and in writing, and lead presentations, training courses, and effective working sessions

• Embraces emerging technologies, including AI tools, to work smarter, solve problems, and drive better business outcomes.

Travel Requirements:

• Up to 10 % travel

Physical Requirements:

• Sedentary work

• Substantial movement of the wrists, hands, and/or fingers for a minimum of 8 hours a day

• Required to have close visual acuity to view computer terminal and/or extensive reading for a minimum of 8 hours a day

We use Greenhouse Software as our applicant tracking system and Zoom Scheduler for HR screen request scheduling. At times, your email may block our communication with you. Please be sure to check your SPAM folder so that you don't miss updates on your application.

Why GuidePoint?

GuidePoint Security is a rapidly growing, profitable, privately-held value added reseller that focuses exclusively on Information Security. Since its inception in 2011, GuidePoint has grown to over 1,300 employees, established strategic partnerships with leading security vendors, and serves as a trusted advisor to more than 6,200 customers.

Firmly-defined core values drive all aspects of the business, which have been paramount to the company’s success and establishment of an enjoyable workplace atmosphere. At GuidePoint, your colleagues are knowledgeable, skilled, and experienced and will seek to collaborate and provide mentorship and guidance at every opportunity.

This is a unique and rare opportunity to grow your career along with one of the fastest growing companies in the nation.

Some added perks….

• Remote workforce primarily (U.S. based only, some travel may be required for certain positions, working on-site may be required for Federal positions)

• Group Medical Insurance options: Zero Deductible PPO Plan (GuidePoint pays 90% of the premium for employees and 70% for family plans (spouse/children/family) or High Deductible Health Plan with HSA (GuidePoint pays 100% of the employees premiums and 75% for family plans (spouse/children/family). If you choose the High Deductible / HSA plan, GPS will contribute in 4 equal quarterly installments: ($850 per EE annually / $1750 per family annually (includes spouse/children/family options)

• Group Dental Insurance: GuidePoint pays 100% of the premium for employees and 75% of family plans

• 12 corporate holidays and a Flexible Time Off (FTO) program

• Healthy mobile phone and home internet allowance

• Eligibility for retirement plan after 2 months at open enrollment

• Pet Benefit Option