Senior Cloud Security Engineer

Role overview

Identity and access management

• Process PIM role assignments, access elevations, time-bound privileged access approvals, and scheduled access reviews.
• Create and manage app registrations and service principals, including credential rotation, API permission scoping, and consent actions.
• Provision system-assigned and user-assigned managed identities for application and platform teams.
• Implement Conditional Access and MFA changes and troubleshoot authentication and access issues.
• Configure and troubleshoot single sign-on and federation for platform applications.

Security automation and cloud operations

• Build, maintain, and troubleshoot Logic Apps automations for IOC blocking, agent health checks, and DNS change alerting; respond to failures.
• Apply Azure Policy assignments against approved baselines and remediate non-compliant resources.
• Monitor Defender for Cloud secure scores and recommendations, action remediation, and track resolution.
• Monitor and investigate server and container threat alerts, including AKS; process just-in-time access requests and apply secure configuration changes.
• Administer Defender for endpoints and Intune, including onboarding devices, deploying applications and certificates, and troubleshooting compliance issues.

PKI and certificate operations

• Operate internal certificate authorities, including private CAs hosted in GCP.
• Process certificate issuance, renewal, and revocation under existing PKI policy and standards.
• Manage Azure Key Vault keys and secrets, including rotation and access-policy updates.
• Maintain certificate and key inventories and monitor upcoming expiries and flagged misconfigurations.

Qualifications

• Bachelor's or college degree in Computer Science, Information Technology, or a related field.
• Eight to ten years of hands-on L2/L3 cloud security operations experience.
• Demonstrable Microsoft Entra ID administration, including RBAC, PIM, app registrations, managed identities, and Conditional Access.
• Experience operating Microsoft Defender across cloud, server, container, and endpoint workloads and handling PKI and certificate operations.
• Experience with ITSM incident and change processes is required; multi-cloud experience across Azure, OCI, and/or GCP is a plus.
• Relevant professional certifications are highly desirable, including listed Microsoft, Google Cloud, CISSP, CCSP, CSA CCSK, or GIAC credentials.
• Working knowledge of identity and privileged access, PKI fundamentals, cloud workload protection, and ticket-driven processes; ability to follow runbooks accurately under time pressure.