US LBM Cybersecurity Engineer – Azure DevSecOps

About this role

US LBM is one of the leading and fastest growing distributors of specialty building materials in the United States, with a team of over 13,000 employees located throughout the country. Since our founding in 2009, we have acquired over 100 companies and have expanded to more than 450 locations serving 37 states. US LBM is a progressive organization that promotes a unique culture that focuses on the value of its customers and associates. Developing our people is critical to our strategy and fostering our culture of empowerment.
.
A Brief Overview
The US LBM Cybersecurity Engineer – Azure DevSecOps is part of the Cybersecurity Solutions team and is responsible for securing cloud-native application workloads across their full lifecycle — from code and pipeline through cloud runtime and the data platforms they integrate with. This role requires a strong software engineering background: the ability to read and reason code, work fluently in CI/CD pipelines, and understand how modern applications are built, deployed, and integrated with cloud data services.
As an engineering-first security role, candidates should come from a developer, DevOps, or platform engineering background with a demonstrated knowledge in security. This role owns cloud-native application protection, DevSecOps pipeline security, and the security of data platforms — both Azure-native services such as Cosmos DB and third-party that integrate with Azure workloads, as well as the security of AI-assisted development tools and AI agent platforms increasingly embedded in the software development lifecycle.
Key Responsibilities:

• Implement and manage Microsoft Defender for Cloud (CNAPP) across Azure workloads, covering both cloud security posture management (CSPM) and cloud workload protection (CWPP) for virtual machines, Azure Kubernetes Service (AKS) containers, and serverless functions.

• Own the DevSecOps program using Snyk for SAST, DAST, and software composition analysis (SCA), integrated directly into CI/CD pipelines (Azure DevOps, GitHub Actions).

• Write and maintain Infrastructure as Code (Terraform, Bicep, ARM templates) with security controls embedded by default — policy-as-code and guardrails rather than after-the-fact review.

• Secure data platform integrations between Azure workloads and downstream data services, including Azure-native platforms (Cosmos DB), third-party managed databases (MongoDB Atlas), streaming platforms (RedPanda), and SaaS data warehouses (Snowflake), covering identity/access boundaries, encryption, and data flow security.

• Secure containerized workloads running on Azure Kubernetes Service (AKS), including cluster hardening, workload identity, network policy, and image scanning integrated into the CI/CD pipeline.

• Partner directly with application developers to embed security into the software development lifecycle — code review participation, secure coding guidance, and remediation support for vulnerabilities identified by Snyk.

• Build and maintain custom tooling, scripts, and APIs to automate security checks, policy enforcement, and reporting across the cloud-native environment.

• Conduct threat modeling for cloud-native workloads and their data integrations, developing corresponding detection and automation use cases.

• Evaluate and integrate new cloud-native and data platform technologies as the organization's architecture evolves, including technology integration from mergers and acquisitions.

• Secure the adoption of AI-assisted development tools (e.g., Cursor, Claude Code) and AI agent/model platforms (e.g., Azure AI Foundry), including governance of code and secrets exposure, access scoping for AI coding agents, and safe integration of AI-generated code into the CI/CD pipeline.

• Ensure DevSecOps and cloud-native practices align with Zero Trust and NIST Cybersecurity Framework principles.

• May design and build internal web applications for the Cybersecurity Solutions team, such as security reporting dashboards, self-service tooling, and workflow automation portals.

Required and Preferred Knowledge, Skills, and Abilities:

• Prior experience as a software engineer, DevOps engineer, or platform engineer — hands-on coding experience is required, not just security tooling experience.

• Proficiency in at least one modern programming language (Python, C#/.NET, Go, or JavaScript/TypeScript) — able to read, write, and debug application code.

• Hands-on experience with CI/CD pipelines (Azure DevOps, GitHub Actions, or similar) and Infrastructure as Code (Terraform, Bicep, or ARM templates).

• Experience integrating or securing cloud-native data platforms — Cosmos DB, MongoDB Atlas, RedPanda, Snowflake, Databricks, or similar managed data and streaming services.

• Familiarity with Microsoft Defender for Cloud or comparable CNAPP/CWPP/CSPM tooling.

• Experience with Kubernetes/Azure Kubernetes Service (AKS) — container orchestration, cluster security configuration, and securing containerized workloads.

• Understanding of the security implications of AI-assisted software development — including AI coding assistants (Cursor, Claude Code) and AI agent/model platforms (Azure AI Foundry) — and how to govern their access to code, secrets, and infrastructure.

• Experience with SAST/DAST/SCA tools (Snyk preferred; Checkmarx, Veracode, or similar acceptable).

• Understanding of API design, authentication (OAuth2, service principals, managed identities), and secure service-to-service integration patterns.

• Ability to communicate security requirements to developers in terms that fit their existing workflow, rather than requiring separate security-only processes.

• Strong understanding of security frameworks such as Zero Trust and the NIST Cybersecurity Framework.

• Able to support multiple concurrent workstreams in a highly matrix, fast-paced, multi-site organization experiencing rapid growth.

• Strong interpersonal and communication skills, with a collaborative,…