Senior IT Security Engineer

About Draganfly

Role overview

Identity, endpoint, and cloud security

• Manage Entra ID controls, including MFA, Conditional Access, least privilege, administrative access, SSO, access reviews, service identities, and lifecycle processes.
• Configure Microsoft 365 endpoint, email, information protection, secure sharing, retention, and DLP controls.
• Secure AWS workloads using network controls, logging, encryption, secrets management, and configuration monitoring.
• Manage Intune compliance, security baselines, encryption, endpoint protection, patching, and BYOD controls.
• Automate security checks, reporting, and remediation; partner with Software Engineering on DevSecOps.

Incident response and resilience

• Investigate risky sign-ins, compromised accounts, malicious email, endpoint alerts, and unauthorized access.
• Coordinate incident triage, containment, recovery, escalation, monitoring, and evidence preservation with managed security providers.
• Conduct vulnerability assessments, coordinate remediation, and retest fixes.
• Support business continuity, disaster recovery testing, tabletop exercises, and crisis response.

Risk, governance, and assurance

• Assess vendors, SaaS platforms, cloud services, and AI tools; review security reports, certifications, architecture, data handling, subcontractors, and controls.
• Track technology risks and remediation and partner with procurement, legal, and business owners on security requirements.
• Translate policies into technical standards and procedures, support security awareness and change management, and maintain the security risk register.
• Map controls to SOC 2, ISO/IEC 27001, NIST CSF, and applicable requirements.
• Lead security projects and approved initiatives; conduct internal audits and control testing, coordinate corrective actions, retest remediation, and lead external audit readiness, including IT general controls and applicable COSO requirements.

Qualifications

• At least five years of relevant IT or information security experience, including hands-on Microsoft 365 and cloud security engineering.
• Experience implementing controls in Azure, AWS, or GCP IaaS/PaaS environments.
• Strong knowledge of Entra ID, Conditional Access, MFA, Intune, endpoint security, cloud workloads, incident response, and vulnerability remediation.
• Practical experience applying frameworks such as SOC 2, ISO/IEC 27001, NIST CSF, COSO, or SOX.
• Experience leading security projects or control assessments, evaluating vendor risk, and using PowerShell or comparable automation.
• Clear communication, independent problem-solving, and cross-functional collaboration.

Preferred qualifications

• A diploma or degree in cybersecurity, computer science, information technology, or a related field, or equivalent practical experience.
• Defense or aerospace experience involving controlled information, NIST SP 800-171, or CMMC Level 2 readiness.
• The source description lists CISSP, CISM, and Microsoft security credentials but is truncated before the full qualification is provided.