Senior Cloud Security Engineer (AWS/Azure)

MARYANN OKOLIE

Senior Cloud Security Engineer Cloud Security Architect

240-***-**** **********@*****.*** Frederick, MD - Remote Green Card Holder

PROFESSIONAL SUMMARY

Senior Cloud Security Engineer with 10+ years of progressive experience across cloud security engineering, security operations, multi-cloud security architecture, identity and access management, threat detection, and enterprise security controls. Hands-on experience securing AWS, Azure, and GCP environments; implementing cloud security posture management with Wiz and Prisma Cloud; designing AWS multi-account governance with Control Tower and Account Factory for Terraform (AFT); and strengthening identity security through AWS IAM Identity Center, Microsoft Entra ID, SCIM provisioning, Conditional Access, and least-privilege access. Experienced in cloud workload and Kubernetes security, vulnerability remediation, encryption and secrets management, security monitoring, incident response, and Python-based automation. Knowledge of regulatory and security frameworks including NIST CSF, ISO 27001, SOC 2, PCI DSS, and HIPAA. Additional experience assessing and governing security risks associated with enterprise AI services.

CORE TECHNICAL SKILLS

•Cloud Platforms & Governance: AWS, Microsoft Azure, GCP, AWS Organizations, AWS Control Tower, Landing Zones, Account Factory for Terraform (AFT), Service Control Policies (SCPs)

•Cloud Security & Posture Management: CNAPP, CSPM, Wiz, Prisma Cloud, Orca, AWS Security Hub, Amazon GuardDuty, Microsoft Defender for Cloud, Microsoft Defender for Endpoint

•Identity & Zero Trust: AWS IAM, AWS IAM Identity Center, Microsoft Entra ID, Okta, SAML 2.0, OIDC, SCIM, RBAC, ABAC, Conditional Access, MFA, PIM/PAM, cross-account access, least privilege

•Threat Detection & Incident Response: Splunk, Microsoft Sentinel, AWS CloudTrail, VPC Flow Logs, Kubernetes audit logs, security alert triage, detection engineering, incident response, threat investigation

•Vulnerability & Workload Security: Qualys, CrowdStrike Falcon, Kubernetes, Amazon EKS, Azure AKS, Docker, Pod Security Standards, OPA Gatekeeper, Falco, Trivy, Aqua Security

•Network & Infrastructure Security: VPC design, network segmentation, security groups, NACLs, firewalls, VPN, AWS Direct Connect, secure hybrid connectivity, production environment isolation

•Data Protection & Cryptography: Microsoft Purview, Varonis, Netskope DLP, Zscaler DLP, data classification, PII/PHI/PCI controls, AWS KMS, envelope encryption, key rotation, HashiCorp Vault, secrets management

•Infrastructure Security & Automation: Terraform, AWS CloudFormation, policy-as-code, OPA, Checkov, tfsec, Python, Boto3, Bash, PowerShell, AWS Lambda, AWS CLI, security baseline automation, remediation workflows

•Security Engineering Tools: GitHub Actions, GitLab CI/CD, SonarQube, Snyk, container image scanning, IaC security validation

•Compliance & Risk Frameworks: NIST CSF, ISO 27001, SOC 2, PCI DSS, HIPAA, Zero Trust, security control assessments, audit evidence, risk remediation

•AI Security (Additional Expertise): Microsoft Copilot and Azure OpenAI security assessments, AI data exposure risks, Shadow AI governance, NIST AI RMF, ISO 42001, OWASP Top 10 for LLM Applications

PROFESSIONAL EXPERIENCE

PwC New York, NY

Senior Cloud Security Engineer February 2022 – Present

Multi-Cloud Security Engineering & Governance

•Directed cloud security engineering across enterprise production environments subject to stringent regulatory requirements, protecting production APIs, customer personally identifiable information (PII), and regulated data through layered identity, network, data, and workload security controls.

•Implemented and managed Wiz CSPM across AWS accounts, centralizing security visibility, prioritizing vulnerabilities by risk, and coordinating remediation workflows with engineering teams through Jira.

•Implemented AWS Organizations governance using Control Tower and Account Factory for Terraform (AFT), establishing multi-account landing zones, Service Control Policies (SCPs), and automated preventive and detective controls.

•Developed Python and AWS Lambda automation to enforce cloud security baselines, rotate IAM credentials, remediate publicly accessible S3 buckets, and execute security response actions.

•Designed encryption and secrets management controls using AWS KMS envelope encryption, automated cryptographic key rotation, HashiCorp Vault, and restrictive key-access policies.

•Engineered centralized Splunk log ingestion for AWS CloudTrail, VPC Flow Logs, GuardDuty findings, Wiz alerts, and Kubernetes audit events, creating correlation logic across security data sources.

Identity, Workload & Infrastructure Security

•Configured federated identity between AWS IAM Identity Center and Microsoft Entra ID using SCIM-based provisioning, automating account lifecycle management and enforcing MFA and Conditional Access across cloud and SaaS platforms.

•Strengthened Amazon EKS security through Pod Security Standards, container network segmentation, OPA Gatekeeper admission policies, and Falco-based runtime threat monitoring.

•Applied Terraform security checks and policy-as-code controls using Checkov, tfsec, and Open Policy Agent (OPA) to identify noncompliant infrastructure configurations before deployment.

•Integrated SonarQube, Snyk, and Trivy checks into GitHub Actions workflows to identify code, dependency, and container vulnerabilities as supporting controls within the broader cloud security program.

•Strengthened security detection by developing Splunk rules for suspicious identity activity, potential credential misuse, and data leakage; integrated alerts into SOC workflows and helped reduce mean time to respond (MTTR) by 40%.

•Designed and maintained data protection controls with Microsoft Purview, Netskope, and Zscaler to reduce unauthorized data sharing and improve visibility into sensitive information exposure.

•Conducted security assessments of Microsoft Copilot and Azure OpenAI deployments, reviewing access permissions, sensitive-data exposure, and integration risks; contributed to AI risk assessment practices aligned with NIST AI RMF and ISO 42001.

•Served as the primary cloud security liaison for internal audit teams and external assessors during SOC 2 and PCI DSS reviews, coordinating evidence collection, audit responses, and remediation tracking.

•Guided mid-level security engineers through threat modeling, security architecture assessments, and technical reviews to improve the quality and consistency of security control implementation.

Cigna Remote

Cloud Security Engineer April 2016 – February 2022

•Protected AWS and Azure environments hosting production healthcare applications and customer-facing services, maintaining security controls aligned with HIPAA and SOC 2 requirements.

•Implemented Palo Alto Prisma Cloud CNAPP to improve continuous compliance oversight, enforce security policies, and identify and remediate cloud configuration risks across AWS and Azure.

•Designed and maintained IAM controls using AWS IAM and Azure Active Directory (Microsoft Entra ID), enforcing MFA, Conditional Access, and least-privilege access assignments.

•Strengthened container and Kubernetes workload security through image vulnerability scanning, RBAC, and container configuration hardening.

•Developed reusable Terraform and AWS CloudFormation modules with embedded security baselines to help engineering teams deploy compliant cloud infrastructure.

•Established centralized cloud security monitoring with AWS Security Hub, GuardDuty, and CloudWatch, refining detections for unusual data access, suspicious activity, and potential privilege escalation.

•Improved cloud network security through segmented VPC designs, security groups, network access control lists (NACLs), and secure hybrid connectivity using VPN and AWS Direct Connect.

•Created Python-based automation to integrate cloud security platforms with SIEM solutions, streamline alert handling, and support incident response workflows.

•Supported SOC 2 and ISO 27001 audits by gathering security control evidence, participating in technical walkthroughs, documenting gaps, and coordinating remediation plans.

The Hartford North Carolina

Security Engineer March 2014 – April 2016

•Led security engineering activities for enterprise production systems, applying security-by-design practices and implementing scalable controls across on-premises infrastructure and emerging cloud environments.

•Implemented CrowdStrike Falcon across enterprise systems, configuring threat detection and prevention policies and coordinating incident escalation and response with the Security Operations Center (SOC).

•Developed Splunk source types and correlation searches for application telemetry and security events to connect application anomalies with potential infrastructure threats.

•Supported secure software delivery by integrating SonarQube static application security testing into development workflows and working with engineering teams to prioritize and remediate vulnerabilities.

•Designed network segmentation using VLANs and firewall access rules to restrict lateral movement and isolate production, staging, and development environments.

The Hartford North Carolina

IT Security Analyst January 2013 – March 2014

•Performed daily security operations by analyzing alerts, refining Splunk detection rules to reduce false positives, and coordinating investigations with IT operations teams.

•Managed CrowdStrike Falcon endpoint protection, tuning detection policies to identify potential data exfiltration attempts and protect organizational assets.

•Managed vulnerability assessment activities using Qualys, including scan configuration, false-positive validation, vulnerability analysis, and remediation coordination with system owners.

CERTIFICATIONS & EDUCATION

•AWS Certified Security – Specialty

•AWS Solutions Architect – Professional

•Microsoft Certified: Azure Security Engineer Associate

•Certified Cloud Security Professional (CCSP)

•CompTIA Security+

•Certified Terraform Professional

•Certified Scrum Master (CSM)

•Bachelor of Science in Computer Engineering

•Master’s Degree in Cybersecurity & Information Assurance

Contact this candidate