Senior Cloud Security Engineer

We are seeking a hands-on Senior Cloud Security Engineer to establish and strengthen continuous security monitoring, detection engineering, incident response, and security operations across cloud, endpoint, network, and on-premises environments. This individual will play a critical role in identifying, investigating, and resolving security events while working closely with engineering, infrastructure, networking, compliance, and leadership teams.

The ideal candidate combines strong technical security engineering experience with expertise in cloud security operations, SIEM platforms, threat detection, incident response, and federal cybersecurity requirements.

• Own continuous security monitoring across cloud, endpoint, network, and on-premises environments.
• Administer and optimize Microsoft Sentinel or comparable SIEM platforms, including data connectors, analytics rules, alerting, dashboards, workbooks, and automation.
• Monitor and manage AWS security services, including Guard Duty, Security Hub, Cloud Trail, Cloud Watch, and IAM.
• Develop and maintain security detections, correlation rules, use cases, and alert thresholds.
• Improve threat visibility while reducing false positives and alert fatigue.
• Identify gaps in logging, monitoring, and detection coverage and implement corrective actions.
• Support threat hunting, security analytics, and proactive identification of emerging risks.

• Investigate security alerts, anomalous activity, potential compromises, and policy violations.
• Lead incident triage, containment, eradication, recovery, and post-incident review activities.
• Develop, maintain, and exercise incident response plans, playbooks, escalation procedures, and communication processes.
• Ensure security incidents and events are properly documented with sufficient evidence for internal and external assessments.
• Monitor endpoint security and EDR platforms and investigate suspicious endpoint activity.
• Establish and maintain centralized security logging, retention, review, and audit capabilities.

• Coordinate vulnerability findings with infrastructure and application teams to prioritize remediation.
• Track remediation activities and verify that identified security issues have been resolved.
• Support risk assessments and identify gaps in security controls.
• Provide technical recommendations to strengthen security posture and reduce operational risk.

• Work with compliance and technical teams to align operational security activities with applicable cybersecurity requirements.
• Support the operational execution and evidence collection associated with NIST SP 800-171 and related security frameworks.
• Maintain documentation and evidence demonstrating that required security processes are actively operating.
• Support government assessments, audits, customer security reviews, and other compliance activities.
• Assist with the development and maintenance of security policies, procedures, standards, and operating documentation.

• Provide technical input into security architecture, cloud deployments, network design, and new technology implementations.
• Develop meaningful security operations metrics, including alert volumes, response times, incident trends, remediation status, and detection coverage.
• Partner with engineering teams to improve security controls, processes, and operational capabilities.
• Identify opportunities for automation, workflow improvements, and more efficient incident response processes.
• Provide leadership with clear visibility into security posture, operational risk, and emerging threats.

• 5+ years of experience in cybersecurity, security operations, cloud security, or related engineering roles.
• Demonstrated experience with SIEM administration, detection engineering, alert investigation, and incident response.
• Hands- on experience with Microsoft Sentinel or a comparable enterprise SIEM platform.
• Experience with AWS security services, including Guard Duty, Security Hub, Cloud Trail, IAM, and Cloud Watch.
• Experience with endpoint detection and response technologies.
• Strong understanding of security logging, event correlation, threat detection, and incident investigation.
• Experience operating in Microsoft Azure and AWS environments.
• Working knowledge of network security, firewalls, identity systems, endpoints, and hybrid…