Cloud Security Engineer

Cloud Security Engineer who lives and breathes Azure security.

Someone who can tune Defender for Cloud, enforce guardrails with policy-as-code, and build real detections in Sentinel, not just check compliance boxes. If you're deep in Entra , Terraform, and KQL and want to bring security into the engineering conversation early, this one's worth a look.

• Operate and tune Microsoft Defender for Cloud (CSPM/CNAPP) across Azure subscriptions, remediating misconfigurations and excessive access
• Enforce preventative guardrails with Azure Policy and benchmark against CIS Benchmarks and NIST CSF
• Apply least-privilege access in Microsoft Entra  Azure RBAC, PIM, and Conditional Access, plus periodic access reviews
• Use Microsoft Purview and Defender for Cloud DSPM to classify and protect sensitive cloud data
• Embed security into Terraform and Git Hub Actions pipelines;
  IaC scanning, policy-as-code, secrets management
• Support threat modeling and secure design reviews for new and changing cloud workloads
• Engineer Sentinel data ingestion (connectors, Data Collection Rules/Endpoints) and build detections
• Integrate Defender for Cloud and Defender XDR signals into Sentinel for unified detection and response

• 3+ years in cloud security or cloud engineering, with hands-on Azure security experience
• Microsoft Defender for Cloud, Azure Policy, Microsoft Entra  (RBAC, PIM, Conditional Access)
• CSPM/CNAPP experience — finding and fixing misconfigurations and excessive access

• Terraform (IaC) and CI/CD security in Git Hub Actions
• Scripting/automation in Python, Power Shell, and KQL (GenAI‑assisted scripting welcomed)

• Security architecture, design review, and threat modeling; working knowledge of NIST CSF and CIS Benchmarks

• AZ-500, SC-100, or a relevant GIAC credential (GCSA, GCDA, or GCFR)

• Hands‑on AWS security (Azure-primary role)
• Git Hub Advanced Security (GHAS); container/Kubernetes (AKS) security
• Secrets and key management (Azure Key Vault)