Cyber Security Cloud Engineer

Company Overview 

NCS is a leading industrial products, services and technology company whose primary end-market is car wash operators.   NCS provides a full suite of manufactured equipment, installation project services, aftermarket parts and services, chemicals (detergents, protectants, etc.), and software.   More specifically with equipment, NCS provides tunnel equipment, IBA (In Bay Automatic), vacuums, dryers, water systems, doors, signage, arches, and related components.     NCS also sells a range of brands – on both equipment, chemicals and software today – including Armor All, Rain-X, Blue Coral, TSS, VacuTech, NCS, AMP, etc.   The company sells primarily in N. America, operates 6 manufacturing plants across N. America, and has ~1600+ employees.   The Company operates numerous Distribution Centers and has sales/HQ offices across N. America, with its primary corporate offices in Des Moines, Iowa and Dallas, TX.   NCS is currently owned by Berkshire Partners, a leading Boston-based PE firm 

 We are interested in every qualified candidate who is eligible to work in the United States. However, we are not currently able to sponsor work visas. 

POSITION SUMMARY 

The Cyber Security Cloud Engineer is the hands-on engineer responsible for implementing, operating, and maturing security controls across NCS's cloud environment, including Microsoft Azure, Amazon Web Services, and the enterprise SaaS platforms that run the business. NCS operates within an established set of NIST-based enterprise security requirements that define the controls, reporting cadences, and audit expectations for the business. This role implements the security controls that protect our cloud, SaaS, identity, workload, and data environments, and serves as the security lead for integrating newly acquired companies into the NCS security framework. As NCS invests in AI to transform how we serve customers and run the business, this engineer ensures those initiatives are deployed with the required safeguards in place. The engineer also partners with Product Engineering and DevOps teams to put required security controls into practice across the software development lifecycle for NCS products, connected equipment, and customer-facing platforms. The role works closely with Infrastructure, Networking, Data, Application Development, and business stakeholders, and provides security leadership with clear visibility into control status, gaps, and remediation progress. Success in this role means delivering required controls on schedule, demonstrating their effectiveness, and reducing enterprise risk without slowing the business. 

KEY RESPONSIBILITIES 

Cloud Security Implementation & Operations 

• Implement and maintain security controls across Azure and AWS in accordance with NCS security requirements and the enterprise security framework, including identity and access management, network segmentation, encryption and key management, logging, and workload protection. 

• Deploy and operate cloud security posture management (CSPM/CNAPP), infrastructure-as-code guardrails, policy-as-code, and automated compliance checks that enforce required baselines and provide continuous evidence of control effectiveness. 

• Operate and tune cloud-native security services (e.g., Microsoft Defender for Cloud, Microsoft Sentinel, Entra ID Protection, AWS GuardDuty, Security Hub, CloudTrail, IAM Access Analyzer) and integrate cloud telemetry into enterprise SIEM detection and response workflows. 

• Execute detection engineering and incident response for cloud-hosted and identity-centric threats, including alert triage, investigation, root cause analysis, containment, and remediation coordination with managed security providers, following established playbooks and escalation paths; track emerging cloud attack techniques and recommend updates to detections, hardening, and response procedures. 

Acquisition Integration & Migration 

• Support cybersecurity due diligence for acquisitions by executing technical assessments of target environments and documenting gaps against NCS security requirements to inform prioritized integration plans. 

• Execute the secure integration and migration of acquired companies onto NCS platforms, including identity consolidation into Microsoft Entra ID, tenant-to-tenant Microsoft 365 migrations, workload migrations to Azure and AWS, network and endpoint onboarding, and decommissioning of legacy infrastructure. 

• Maintain and follow repeatable, documented integration playbooks and security baselines that bring acquired entities to the required security standard within defined integration timelines, with status reporting throughout. 

DevOps & Product Security 

• Implement and operate required security controls across the CI/CD pipeline in partnership with Product Engineering and DevOps teams, including static and dynamic application security testing (SAST/DAST), software composition analysis, secrets scanning, container image scanning, and software bill of materials (SBOM) generation, with risk-based gates that protect release velocity. 

• Support secure product development for NCS software, connected equipment, and customer-facing platforms through threat modeling, secure design reviews, application of secure coding standards, API security, and vulnerability management, with particular attention to payment-enabled and field-deployed systems. 

• Track product security metrics, maintain developer-facing documentation, and uphold remediation SLAs that give engineering teams clear, actionable ownership of security findings. 

Compliance, Reporting & Leadership 

• Implement the data protection, DLP, identity governance, and access controls required to securely enable approved AI initiatives, including Microsoft 365 Copilot, Azure OpenAI, AWS Bedrock, and enterprise AI tooling, in partnership with Data, IT, and business teams. 

• Maintain security controls across Microsoft 365, identity, endpoint (Windows and Apple), and cloud platforms in line with NCS security requirements; produce the evidence, metrics, and documentation needed for PCI-DSS compliance, NIST CSF alignment, internal and external audits, executive security reviews, and customer security assessments. 

• Mentor engineers, serve as the escalation point for complex cloud and identity security issues, and report clearly on control status, gaps, risk, and remediation progress to technical and executive audiences. 

REQUIRED QUALIFICATIONS 

• 5 or more years of progressive experience in IT, with broad exposure to infrastructure, networking, identity, and enterprise systems. 

• 3 or more years of hands-on experience in a dedicated cybersecurity role, including securing production workloads in Microsoft Azure and/or AWS. 

• Demonstrated experience implementing security controls within an established enterprise security framework, including translating defined control requirements, audit findings, and assessment results into deployed, documented, and measurable controls. 

• Hands-on implementation experience with cloud security services and patterns on at least one major platform (Azure or AWS) and solid familiarity with the other, including IAM, network security, encryption and key management, logging, and workload protection. 

• Experience with infrastructure as code (e.g., Terraform, Bicep, CloudFormation), CI/CD platforms (e.g., Azure DevOps, GitHub, GitLab), and application security tooling (SAST/DAST, SCA, secrets and container scanning), with a track record of partnering with development teams to embed security into the SDLC. 

• Working knowledge of the NIST Cybersecurity Framework and experience supporting PCI-DSS compliance and audit or assessment processes, including evidence collection and remediation tracking. 

• Clear, professional written and verbal communication, with the ability to report control status, gaps, and remediation progress to technical and non-technical audiences. 

PREFERRED QUALIFICATIONS 

• One or more current, industry-recognized security certifications such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft Certified: Azure Security Engineer Associate (AZ-500); equivalent demonstrated experience will be considered. 

• Direct experience executing security workstreams for mergers, acquisitions, or divestitures, including tenant-to-tenant migrations and identity consolidation. 

• Experience securing AI/ML platforms and services (Azure OpenAI, AWS Bedrock, Microsoft 365 Copilot, enterprise data platforms) and familiarity with the NIST AI RMF, OWASP Top 10 for LLM Applications, or similar frameworks. 

• Experience with CSPM/CNAPP platforms, container and Kubernetes security, and secrets management. 

• Experience implementing or maturing a product or application security program, including familiarity with OWASP ASVS and SAMM, NIST SSDF, or similar secure development frameworks, and tooling such as GitHub Advanced Security or equivalent integrated DevSecOps platforms. 

• Experience securing embedded, IoT, or payment-enabled products, including PCI-DSS considerations for software and device design. 

• Scripting and automation proficiency (PowerShell, Python, etc.) for detection engineering and security tooling. 

• Experience in manufacturing, distribution, or field service environments, including connected equipment and payment systems. 

CORE COMPETENCIES & LEADERSHIP EXPECTATIONS 

• Takes ownership of assigned controls and initiatives and follows through to measurable, documented completion. 

• Executes with discipline against established standards while exercising sound judgment on how to implement them with minimal business friction. 

• Demonstrates calm, decisive leadership during incidents and high-pressure situations. 

• Provides clear, pragmatic implementation guidance to peers and leadership on cloud, product, and AI risk. 

PHYSICAL REQUIREMENTS & WORK ENVIRONMENT 

• Primarily office-based or remote-office work using a computer and standard office equipment for extended periods. 

• Ability to communicate effectively through phone, video, and in-person meetings. 

• Periodic participation in after-hours incident response or maintenance windows. 

• Occasional travel to NCS facilities and acquired-company locations to support integration activities.  

Grow your career supported by an energized and passionate team, professional development, training, flexibility and opportunities for advancement. We offer competitive wages and benefits including comprehensive health, dental and vision coverage, and more. 

National Carwash Solutions is a proud equal opportunity employer. We are a drug free, EEO employer committed to a diverse workforce. We will consider all qualified candidates regardless of race, color, national origin, sex age, marital status, personal appearance, sexual orientation, gender identity, family responsibilities, disability, education, political affiliation or veteran status.