Cloud Security Engineer

Quick Facts

• Role: Cloud Security Engineer

Description

You will deploy Microsoft Defender for Cloud protections across multiple Azure tenants, centralize audit/resource logging into Microsoft Sentinel, and build KQL detections for data exfiltration behaviors.

Responsibilities include detecting exfiltration across M365, PaaS/SaaS, and Azure IaaS by combining Defender for Cloud, Defender for Servers, firewall and flow logs, Traffic Analytics, and baseline outbound traffic patterns. You will also map exfiltration paths to security controls, document coverage gaps, and deliver triage playbooks/runbooks with escalation paths.

Benefits

• Enterprise-scale work across multiple Azure tenants

• Detection engineering and remediation-focused environment

Requirements

• 5+ years in cloud security engineering, including at least 3 years of hands-on Azure work

• Built and tested custom Microsoft Sentinel exfiltration detections in KQL (unusual volumes, rate changes, abnormal access patterns)

• Deployed Microsoft Defender for Cloud plans at enterprise scale across more than one tenant

• Strong Microsoft Sentinel expertise: data connectors, analytics rules, KQL, workbooks, automation rules

• Experience with Azure Policy and Policy-as-Code, deployed via CI/CD (Azure DevOps or GitHub)

• Solid understanding of M365 audit logs, Entra ID, and Defender XDR/Cloud Apps

• Ability to map exfiltration points to controls and document coverage gaps

• Detection engineering or threat hunting experience focused on data exfiltration

• Experience after an incident or within a remediation program

• Familiarity with formal change processes (e.g., ServiceNow CRQ) and clear documentation

• AWS security setup experience: GuardDuty, CloudTrail, and Organizations-level security

• Microsoft Purview experience: DLP, Insider Risk Management, audit

• Certifications such as SC-200, AZ-500, or SC-100 (AWS Security Specialty is a plus)

Responsibilities

• Deploy Defender for Cloud protections (Key Vault, Storage, Databases, AI, API) using Azure Policy and Policy-as-Code pipelines

• Centralize logging in Microsoft Sentinel by enabling audit/resource logs and connecting Azure, M365, and AWS

• Build and tune KQL exfiltration detections for M365/PaaS/SaaS activity, including Exchange and Microsoft Graph API spikes

• Detect IaaS exfiltration using Defender for Servers plus VNet/NSG flow logs and Traffic Analytics

• Baseline and alert on unusual outbound transfers using firewall logs

• Map exfiltration paths to controls, document coverage gaps, and provide recommendations

• Create triage playbooks/runbooks with defined escalation paths and hand off to InfoSec/SOE