Information Security Cloud Engineer; SME - Project Engagement

Position: Information Security Cloud Engineer (SME) - Project Engagement
Job Description

Bravo Tech a Leader in IT Consulting is seeking a talented Information Security Cloud Engineer / Subject Matter Expert (SME) to lead the design, implementation, and operationalization of a comprehensive cloud security program.
This consultant will establish cloud asset visibility, implement security controls, integrate continuous monitoring capabilities, and strengthen governance, risk, and compliance across enterprise cloud environments.
Required Skills & Experience

• 7+ years of Information Security, Cloud Security, or Security Engineering experience
• Strong expertise securing Azure, AWS, GCP, and/or Oracle Cloud Infrastructure (OCI)
• Experience with cloud security architecture, IAM, network segmentation, vulnerability management, logging, telemetry, and continuous monitoring
• Hands-on experience implementing cloud security baselines and remediation programs
• SIEM/SOC integration experience
• Experience securing Oracle environments including OCI, Oracle ERP/HCM, Oracle databases, and identity/access management
• Strong knowledge of NIST, CIS Controls, Zero Trust, risk management, and compliance frameworks
• Excellent communication, documentation, and stakeholder management skills

Preferred Certifications

• CISSP
• CCSP
• CISM
• GIAC Cloud Security
• Azure Security Engineer
• AWS Security Specialty
• Equivalent cloud security certifications

Key Responsibilities

• Assess cloud environments and security posture
• Establish enterprise cloud asset inventory and ownership mapping
• Develop and implement cloud security standards and hardening controls
• Integrate cloud environments into SOC and continuous monitoring platforms
• Define and report cloud security KPIs and risk metrics
• Support audit, compliance, and governance initiatives
• Create operational runbooks and provide knowledge transfer to internal teams

This role will establish enterprise-wide cloud asset visibility, implement standardized cloud security controls, and integrate continuous monitoring capabilities into the broader information security program. The consultant will serve as a hands-on technical leader focused on reducing cloud security risk, improving governance, strengthening compliance readiness, and enabling long-term operational sustainability.
The ideal candidate brings deep expertise across cloud security architecture, governance, monitoring, risk management, and Oracle-centric enterprise environments.
Job Responsibilities
Cloud Security Assessment & Asset Visibility

• Assess cloud environments, configurations, security posture, and billing structures, providing recommendations aligned to industry best practices
• Identify, document, and maintain a comprehensive inventory of cloud assets including:
  • Accounts, subscriptions, and tenants
  • Compute, storage, database, and networking resources
  • Identity objects, service principals, and managed identities
  • Security tooling integrations and logging sources
• Define asset ownership, business purpose, data classification, and production/non-production tiers
• Implement automated discovery and reconciliation processes where feasible
• Align inventory management practices with enterprise configuration management standards

Security Baseline & Cloud Hardening

• Develop and implement cloud security baseline standards aligned with:
  • Enterprise security policies
  • Regulatory and compliance requirements
  • Industry frameworks including NIST and CIS
• Establish and validate:
  • Secure configuration standards
  • Identity and access controls
  • Logging, monitoring, and telemetry requirements
  • Network segmentation and exposure controls
• Identify, prioritize, and remediate high-risk cloud misconfigurations
• Partner with Infrastructure, Engineering, Application, and Security teams to implement scalable and sustainable security controls

Continuous Monitoring & Detection

• Integrate cloud environments with approved security monitoring and SOC platforms
• Enable continuous monitoring for:
  • Configuration drift
  • Unauthorized or insecure deployments
  • Risky user and identity activity
  • High-risk assets and sensitive workloads
• Establish centralized logging, alerting, escalation criteria, and detection use cases
• Tune monitoring capabilities to reduce noise while maintaining effective risk coverage

Governance, Risk & Compliance

• Integrate cloud security findings into enterprise risk management and audit processes
• Define and report cloud security KPIs/KRIs including:
  • Inventory accuracy and coverage
  • Misconfiguration trends
  • Remediation velocity
  • Monitoring and detection effectiveness
• Produce documentation suitable for audit, regulatory, and executive review
• Support audits, tabletop exercises, and risk briefings as needed

Knowledge Transfer & Operational Sustainability

• Develop operational runbooks, standards, and procedures for cloud inventory management, secure deployment practices, and monitoring escalation
• Provide knowledge transfer and mentoring to Information Security, SOC, IT, and Engineering teams
• Dedicate scheduled time weekly to enhance internal cloud security knowledge and operational maturity
• Ensure the cloud security program is scalable and…