Senior Cloud Security Engineer

Role summary

Identity and security operations

• Process PIM role assignments, time-bound privileged access approvals, and scheduled access reviews.
• Manage app registrations and service principals, including credential rotation, API permissions, consent actions, and managed identity provisioning.
• Implement Conditional Access and MFA changes; troubleshoot authentication/access issues and configure or troubleshoot SSO and federation.
• Maintain Logic Apps security automations and respond to automation failures.
• Apply Azure Policy baselines, remediate non-compliant resources, monitor Defender recommendations, and track remediation.
• Monitor server and container threat alerts, including AKS; investigate suspicious activity, process JIT requests, and apply secure configurations.
• Administer Defender for endpoints and Intune, including onboarding, application/certificate deployment, and device compliance troubleshooting.

PKI and certificate management

• Operate internal Certificate Authorities, including private CAs hosted in GCP, and process certificate issuance, renewal, and revocation under existing policy.
• Manage Azure Key Vault keys and secrets, including rotation and access-policy updates.
• Maintain certificate and key inventories and monitor upcoming expiries and flagged misconfigurations.

Qualifications and experience

• Bachelor's or college degree in Computer Science, Information Technology, or a related field.
• 8–10 years of hands-on cloud security operations experience at L2/L3 level.
• Demonstrable Microsoft Entra ID administration, including RBAC, PIM, app registrations, managed identities, and Conditional Access.
• Experience operating Microsoft Defender across cloud, server, container, and endpoint workloads, and handling PKI/certificate operations.
• Experience with incident and change management processes (ITSM).
• Multi-cloud experience across Azure, OCI, and/or GCP is a plus.

Technical knowledge

• Microsoft Entra ID, Defender for Cloud/Servers/Containers/endpoints, Intune, Azure Policy, Logic Apps, and Azure Key Vault.
• GCP-based PKI/private Certificate Authorities; working knowledge of OCI security controls.
• Identity and privileged access, certificate lifecycle, key management, trust chains, cloud workload protection, and ticket-driven incident/change processes.
• Ability to follow runbooks and standard operating procedures accurately under time pressure.

Certifications

• Relevant professional certifications are highly desirable, including listed Microsoft identity, Azure security, security operations, Azure administration, endpoint administration, and Google Cloud security credentials.
• Vendor-agnostic certifications such as CISSP, CCSP, CSA CCSK, or GIAC are also listed as desirable.