Cloud Security Engineer

We are seeking a hands-on Cloud Security Engineer to strengthen the SOC’s ability to detect, investigate, and respond to threats across Azure and AWS.

This person will serve as the SOC’s cloud security subject matter expert, investigating suspicious activity across cloud identities, workloads, storage, and data services. They will lead technical incident response alongside cloud administrators and application owners, improve detection coverage, and automate common response actions.

Key Responsibilities - Serve as the SOC’s cloud security SME, investigating and responding to security threats across Azure and AWS. - Triage alerts from Microsoft Defender for Cloud, CrowdStrike Next-Gen SIEM, Wiz, AWS GuardDuty, Security Hub, and related tools, distinguishing true threats from misconfigurations and false positives. - Investigate cloud attacks involving compromised identities, privilege escalation, persistence, unauthorized access, data exfiltration, and resource abuse using Azure/AWS logs and telemetry. - Lead technical incident response and recovery, including containment, credential/key rotation, access restriction, workload isolation, evidence preservation, and validation that attacker access has been removed. - Build and tune cloud detections using KQL and improve logging/telemetry coverage across Azure and AWS. - Conduct proactive cloud threat hunting and develop automated response playbooks/runbooks for common cloud security incidents. - Review and help remediate high-risk cloud exposures, including public storage, exposed secrets, excessive permissions, and vulnerable internet-facing workloads. - Partner with SOC, cloud/platform, application, and MDR/MSSP teams to improve cloud detection, response, and overall incident readiness.

• 10+ years of cybersecurity experience, including 5+ years focused on Azure and/or AWS cloud security.
• Hands-on SOC, incident response, or detection and response experience investigating real cloud security incidents.
• Strong Azure knowledge, including Entra ID, RBAC, storage accounts, Key Vault, networking, managed identities, and Azure Activity and diagnostic logs.
• Strong AWS knowledge, including IAM, S3, EC2, VPC, CloudTrail, GuardDuty, and Security Hub.
• Hands-on experience with Microsoft Defender for Cloud, CrowdStrike SaaS Shield, and/or Wiz.
• Experience with CrowdStrike NG-SIEM or a comparable SIEM, including writing KQL queries.
• Strong understanding of cloud identity attacks, privilege escalation, persistence, and data exfiltration.
• Scripting experience with Python, PowerShell, Azure CLI, and/or AWS CLI.
• Ability to communicate technical incidents clearly and explain them in business-risk terms. Experience with Microsoft Fabric/OneLake, Azure Data Factory, Synapse, or similar cloud data platforms. Experience with Microsoft Defender XDR, Defender for Cloud Apps, or CrowdStrike Falcon Cloud Security. Kubernetes and container security experience, including AKS or EKS. Infrastructure-as-code experience with Terraform, Bicep, or CloudFormation. Certifications such as AZ-500, SC-200, AWS Certified Security - Specialty, GCLD, or GCIH. Hands-on ability is valued more than certifications.