Seeking Azure / Kubernetes expert for REMOTE Full Time Contract role

Platform Security Engineer (Azure / Terraform / Kubernetes) FULL TIME CONTRACT ROLE ABOUT THE ROLE Location: Remote Engagement: Full-time | Contract Team: Platform Security / DevSecOps SUMMARY We are seeking an experienced Platform Security Engineer with deep Azure security expertise to lead the migration of legacy applications and services from on-premises and other environments to Azure, and to serve as the security gate for applications onboarding to the OpenShift container platform. Azure is the primary platform for this role, with Kubernetes security as the secondary focus; OpenShift and Terraform experience are preferred. The role sits at the intersection of cloud security, application security, platform engineering, and DevSecOps, responsible for reviewing onboarding requests and driving automation to make the security review process scalable and repeatable. WHAT YOU'LL BE WORKING ON Your primary focus is migrating legacy applications and services from on-prem and other environments into Azure, and acting as the security gate for the OpenShift container platform. On the migration side, you'll assess legacy workloads, define the secure target-state design in Azure, and drive the move with infrastructure as code, preferably Terraform. On the platform side, you'll partner with application teams and platform engineering to ensure onboarding to OpenShift meets security posture requirements, combining hands-on reviews (vulnerability remediation, network policies, manifests) with policy-as-code and admission controls to enforce secure-by-default standards at scale. WHAT WE'RE LOOKING FOR - 4+ years in security engineering, cloud security, DevSecOps, or platform security - Strong hands-on Azure security experience: identity and access, network controls, logging and monitoring, and workload protection - Hands-on Kubernetes security experience in an enterprise environment - OpenShift experience (preferred) - Terraform or comparable infrastructure-as-code experience (preferred) - Practical experience with OPA/Gatekeeper or similar policy-as-code frameworks (Kyverno, Falco) - Familiarity integrating security into CI/CD (SAST/SCA) with build-break controls - Strong understanding of vulnerability management and remediation validation - Experience with RBAC design/implementation and least-privilege access - Working knowledge of network segmentation and microsegmentation concepts - Experience migrating legacy applications and services to cloud RESPONSIBILITIES - Lead security for the migration of legacy applications and services from on-prem and other environments to Azure - Assess legacy workloads for cloud readiness, define the secure Azure target-state design, and validate that migrations land with required controls in place - Design and enforce secure-by-default Azure landing patterns, preferably delivered as Terraform modules - Evaluate application onboarding requests to the OpenShift platform, verifying vulnerabilities identified in the development pipeline have been remediated prior to promotion - Assess requested network communications and segmentation policies for appropriateness and least-privilege alignment - Approve, reject, or conditionally approve onboarding requests with documented rationale - Partner with platform engineering to design and implement policy-as-code capabilities using OPA Gatekeeper to reduce manual review overhead - Develop and maintain admission control policies capable of breaking builds when security posture requirements are not met - Continuously mature the automated policy library to reflect the evolving threat landscape and compliance requirements - Review and validate that build configurations and deployment manifests adhere to secure-by-default standards - Ensure centralized, continuous logging is properly configured across workloads and the platform layer - Manage and enforce Role-Based Access Control (RBAC) across the OpenShift environment, ensuring least-privilege access principles are applied - Operate and tune Red Hat Advanced Cluster Security (ACS) for vulnerability management, runtime threat detection, and compliance - Collaborate with the Guardicore team to support microsegmentation policy enforcement and network visibility - Collaborate with the GitHub Advanced Security team to integrate SAST/SCA findings into the onboarding gate process - Collaborate with the BeyondTrust team to support Just-in-Time (JIT) privileged access workflows on the platform TECHNICAL SKILLS - Azure security architecture and platform hardening (primary) - Cloud migration security: legacy workload assessment, target-state design, cutover validation - Kubernetes / OpenShift security and platform hardening - Infrastructure as code with Terraform (preferred) - OPA Gatekeeper (or similar: Kyverno, Falco) and policy-as-code design - CI/CD security integration (build-break controls, SAST/SCA workflows) - RBAC administration and access governance for cloud and container platforms - Vulnerability management and remediation verification - Network segmentation and microsegmentation fundamentals - Red Hat Advanced Cluster Security (ACS / StackRox) (preferred) - Guardicore (preferred) - GitHub Advanced Security (preferred) - BeyondTrust JIT privileged access workflows (preferred) - Security framework familiarity: NIST, CIS Benchmarks (preferred) - Scripting/automation for policy development: Python, Bash, or Go (preferred) YOU HAVE - Ability to communicate security requirements clearly to development teams without being a blocker - Comfort working across security and platform engineering as a collaborative partner - Detail-oriented approach to documenting decisions and building repeatable processes