Senior Security Engineer

AtEntegrata, we help law firms turn data into decisions. We deploy a turnkey datalakehouse platform that consolidates siloed legal, operational, and financial data into single sources of truth, enabling unified reporting and AI-driven innovation. Founded in 2023 and headquartered in Indianapolis, we’re a fast-growing, venture‑backed SaaS company on a mission to be the data platform of choice for the top law firms in the world.

We’re hiring a Senior Security Engineer to be the dedicated security owner for our Azure platform — running security reviews, keeping our policies and posture current, driving detection and incident response, owning identity and endpoint security, and running our SOC 2 / Drata compliance program day to day. You’ll report to our Security Lead and operate as a senior individual contributor focused squarely on security and compliance.

This is deliberately a security specialist role, not a security-plus-everything generalist
. Day-to-day infrastructure and ops build work — including shipping infrastructure as code — is covered by our team today, with a dedicated Dev Sec Ops  hire planned down the road. You’ll define the security requirements and review how they’re implemented, but you won’t be on the hook for building and operating the platform. The compliance side of this role is a deliberate pairing with security, and may grow into its own function as we scale.

• Security reviews & posture. Review architecture and changes for security impact, keep our security baselines and policies current, and run posture management across the environment (Defender for Cloud), driving findings through to remediation.
• Detection & incident response. Own detection engineering and IR day to day — KQL detections in Log Analytics, Azure Monitor dashboards, SIEM forwarding via Event Hub, and incident.io alerting and runbooks. The Security Lead steps in as incident commander for major events.
• Identity & endpoint security. Own Entra l Access (device‑based policies, Enterprise SSO) and our EDR estate — Sentinel One (primary on macOS), Microsoft Defender (Windows), and the remaining Sophos footprint. Define the device‑security baselines that compliant endpoints must meet.
• Compliance (SOC 2 / Drata). Own our SOC 2 Type II program day to day in Drata — evidence collection, control monitoring, customer security questionnaires, and vendor / third‑party risk — partnering with security, IT, and engineering. This is the security‑to‑compliance bridge, and may grow into a dedicated compliance role as we scale.

• Cloud & Azure security. Shape posture, guardrails, and Defender for Cloud coverage together with the Security Lead.
• Security as code. Define the security requirements and guardrails that get implemented in our Pulumi (Go) IaC, and review and contribute to that code. Building and operating the infrastructure is owned by the team today, with a future Dev Sec Ops  hire — you set and verify the security bar, you don’t own the build.
• Device management. A separate IT hire owns Microsoft Intune and patching; you set the device‑security baselines (compliance policies, LAPS, Bit Locker/File Vault, ASR rules, removable‑media controls) and partner on patch posture.

• Cloud security depth (Azure). Hands‑on securing Azure — identity (Entra , RBAC, managed identities, PIM), network, and secrets / key management (Key Vault, customer‑managed keys).
• Identity & endpoint. Practical experience with Entra Conditional Access and at least one major EDR platform (Sentinel One, Microsoft Defender, or equivalent).
• Detection & IR. Detection‑engineering and incident‑response experience, including writing KQL against Log Analytics or a comparable SIEM, and running investigations end to end.
• Security reviews & policy. Experience running security and architecture reviews and maintaining security policies and posture.
• Compliance. SOC 2 Type II experience, ideally hands‑on with Drata or a comparable platform — comfortable owning evidence, controls, and customer security questionnaires.
• Ownership. A senior IC who can run the security function independently and partner across…