Cloud Security Engineer - Azure Cloud Migration
Job Title – Cloud Security Engineer Location - Remote (United States only) Experience - 10+ years Employment Type – Contract Duration – 12/2026 – 2/2028 CitiusTech is a leading digital and enterprise AI company for healthcare and life sciences organizations. We enable 140+ enterprises to build a human-first ecosystem that is efficient, effective, and equitable. Leveraging deep domain expertise and next-generation technologies including AI, Cloud, Data, and Intelligent Automation, we assist our clients to realize their vision, accelerate transformation, and achieve business outcomes. With 7,700+ healthcare technology professionals worldwide, CitiusTech powers digital innovation, business transformation, and industry-wide convergence through next-generation technologies, solutions, and products. Why CitiusTech Healthcare isn't just another industry for us. It's our singular focus. For 21+ years, we have combined technology and domain expertise to shape better healthcare outcomes. As part of CitiusTech, you will build future-ready skills while becoming an expert in a domain where innovation creates real human impact. Here's an opportunity to be part of that journey. Position Summary We are hiring a Cloud Security Engineer to make sure every workload in a multi-wave data center migration to Microsoft Azure is secure and compliant from its first day in Azure, for a US healthcare payer. You will work alongside the Cloud Architect and the migration engineers, and with the client's security, identity, network, and compliance teams. The migration runs as a factory, and security is checked at each stage: design review, pre-migration readiness, the approval gate before CAB, cutover, and hypercare. You own those checks and the evidence behind them. The program is moving identity from on-premises Active Directory to Entra ID, brokers privileged access through CyberArk, and sends security telemetry to Microsoft Sentinel, all under HIPAA, HITECH, and HITRUST. This is a hands-on role. You will configure and validate controls, read firewall and sign-in logs, and produce the evidence an auditor or approver needs, while keeping the migration moving.
Key Responsibilities
Security standards and guardrails Define and maintain the Azure security baseline for migrated workloads: Azure Policy initiatives, Defender for Cloud, encryption at rest and in transit, and diagnostic settings, aligned with the landing zone and Zero Trust principles. Review each application's design and migration playbook for security before approval, and map its controls to HIPAA, HITECH, and HITRUST requirements. Keep security patterns, checklists, and diagrams current so the migration team applies them the same way every time. Identity and privileged access Work with the Identity team on the move from on-premises Active Directory to Entra ID and Entra Domain Services: assess the impact on Kerberos, service accounts, and domain join for each application. Validate RBAC assignments, least privilege, PIM, Conditional Access, MFA, and break-glass accounts. Support onboarding of privileged accounts and administrative sessions to CyberArk, and confirm Bastion-only administration. Make sure secrets, keys, and certificates are held in Key Vault, and that certificates stay valid through cutover. Network security Review and validate Azure Firewall rules, NSGs, segmentation, private endpoints, and private access paths for each workload. Confirm migrated workloads reach on-premises systems only through approved paths, using firewall logs as evidence. Migration wave security Run a pre-migration security readiness assessment for each application. Validate security configuration during cutover and hypercare, and drive quick remediation of findings without stalling the wave. Provide the security evidence for each approval gate and CAB submission. Monitoring, detection, and response Confirm security telemetry from every migrated workload reaches the SIEM (Microsoft Sentinel, with Splunk during the transition) and that alerts fire as expected. Support incident response and root-cause analysis for migrated workloads. Compliance, audit, and handover Collect and maintain compliance evidence: access controls, encryption, logging, and retention. Track security gaps to closure, and support risk assessments and audit requests. Hand over to operational security teams with runbooks and knowledge transfer after each wave.
Qualifications
Required 10+ years in information or cloud security engineering, including 3+ years hands-on securing Microsoft Azure workloads. Strong working knowledge of Azure Policy, Defender for Cloud, RBAC, PIM, Conditional Access, Key Vault, and diagnostic settings. Azure network security: Azure Firewall, NSGs, private endpoints, and hub-and-spoke or Virtual WAN designs. Security delivery on at least one data center to Azure migration. Hybrid identity: Entra ID with on-premises Active Directory, including Kerberos, service accounts, and domain services. SIEM integration and log validation with Microsoft Sentinel or Splunk. Experience in healthcare, working under HIPAA. Preferred Health plan or payer organizations. Entra Domain Services, and CyberArk Privilege Cloud or PAS. HITRUST assessments and evidence collection. Azure landing zones, the Cloud Adoption Framework, and Zero Trust. Policy as code, and reviewing Bicep templates for security. Zscaler, Palo Alto, or certificate management platforms such as Venafi. Certifications (preferred) Azure Security Engineer Associate (AZ-500) Identity and Access Administrator Associate (SC-300) Cybersecurity Architect Expert (SC-100) Employment Type – Contract Duration – 12/2026 – 2/2028 Compensation - $80-$90/hr Life at CitiusTech We focus on building highly motivated engineering teams and thought leaders with an entrepreneurial mindset, centered on our core values of Passion, Respect, Openness, Unity, and Depth (PROUD) of knowledge. Our success lies in creating a fun, transparent, non-hierarchical, diverse work culture that focuses on continuous learning and work-life balance. Rated by our employees as the ‘Great Place to Work for’ according to the Great Place to Work survey. We offer you a comprehensive set of benefits to ensure that you have a long and rewarding career with us. Our EVP Be You Be Awesome is our EVP and it reflects our continuing efforts to create CitiusTech as a great place to work where our employees can thrive, both personally and professionally. It encompasses the unique benefits and opportunities we offer to support your growth, well-being, and success throughout your journey with us and beyond. Together with our clients, we are solving some of the greatest healthcare challenges and positively impacting human lives. Welcome to the world of Faster Growth, Higher Learning, and Stronger Impact. Join CitiusTech. Be You. Be Awesome. To learn more about CitiusTech, visit and follow us on Disclosures: - This posting complies with applicable pay transparency laws in states such as California, Colorado, New York, New Jersey, Illinois, and others. CitiusTech is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status.