> Markdown version of [/jobs/ext/4669774-cloud-security-engineer](https://www.wearedevelopers.com/jobs/ext/4669774-cloud-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Cloud Security Engineer

- **Company:** SAND TECH LLC
- **Location:** United States
- **Experience:** Experienced
- **Contract:** Permanent contract
- **Skills:** Kubernetes Security, Amazon Web Services, Microsoft Azure, Software as a Service, Cloud Computing, Cloud Computing Security, Collaborative Software, CompTIA Security+, Cyber Security, Data Deduplication, DevOps, JSON, Python (Programming Language), Microsoft Security Essentials, Software Product Management, Anti-Phishing, Kusto Query Language, SQL Databases, Software Vulnerability Management, Scripting, Google Cloud, Microsoft InTune, Microsoft Sentinel, Restful APIs, Terraform, Data Pipelines, Qualys, Vulnerability Analysis
- **Published:** November 11, 2026
- **Apply:** https://startup.jobs/cloud-security-engineer-sand-tech-holdings-limited-c-10737746

## About the Role

* grounded by at least 5-7 years of professional cloud/DevOps experience and at least 2-4 years in security engineering, cloud/DevOps with a security focus, or security operations
 * Working proficiency in at least one major cloud (AWS, Azure, or GCP) and hunger to learn the other two
 * Scripting for automation - Python preferred; comfort with REST APIs and structured data (JSON/CSV); KQL or SQL a plus
 * Understanding of vulnerability management fundamentals (CVE/CVSS, scanning vs. remediation, SLA-driven programs) and a calm, methodical approach to incident response
 * Clear writing and the ability to explain a finding to an engineer and its risk to an executive
 * Self-direction - you'll have a director's guidance, not a script

Preferred experience

 * Hands-on time with Microsoft Defender / Sentinel, or Qualys
 * Terraform or other infrastructure-as-code exposure
 * Container security (ECR/AKS image scanning, lifecycle policies)
 * Cyber Essentials, ISO 27001, SOC 2, or ISO/IEC 42001 evidence experience
 * Relevant certifications: SC-200, AZ-500, Security+ (or equivalent demonstrated skill)

How we work

Due to the highly collaborative and internationally distributed nature of our work, successful candidates must be comfortable operating in small teams while contributing to larger, globally coordinated efforts. A strong sense of ownership, self-motivation and discipline in maintaining clear and consistent communication through virtual collaboration tools and video conferencing is essential.

## Description

Sand Technologies is standing up its security engineering capability, and you'll be engineer #1, working directly with the Director of Cyber Security. We are looking for a candidate with subject matter expertise in implementation and management of cloud security across AWS, Azure, and GCP.

This is a hands-on role, with an opportunity to have a deep impact on audits, executive metrics, and the security of a live AI product. Most junior security roles are ticket queues. This one is a program build: you'll touch three clouds, a modern Microsoft security stack, audit evidence for four frameworks, and the security posture of a shipping AI product - with direct mentorship from a security director and visible impact into executive reporting from your first quarter.

What you'll do

 * Serve as second responder on security incidents across Sand: fraud, phishing, endpoint, identity, shadow IT, and cloud, running evidence collection, triage, containment coordination, and lessons learned
 * Operate and tune our security stack: Microsoft Defender for Cloud/Endpoint, Intune, Sentinel, and vulnerability scanning across a multi-account AWS organization, GCP, and Azure
 * Build and maintain the vulnerability data pipeline: raw exports from cloud-native tools, deduplication by unique CVE, finding-age and SLA computation, and the feeds behind our security metrics
 * Run tooling validations - side-by-side parity testing when we transition platforms, with evidence that stands up to audit
 * Partner with infrastructure/DevOps teams on remediation: container base-image hygiene, registry lifecycle policies, exposure management, and verifying closure on the next scan
 * Track remediation SLAs, support exception and risk-acceptance workflows, and keep runbooks and process documentation current
 * Build detection in Microsoft Sentinel: onboarding and tuning log sources across email, identity, endpoint, SaaS, and cloud
 * Embed security gates in CI/CD pipelines and stand up telemetry for new environments
 * Contribute evidence to Cyber Essentials, ISO 27001, SOC 2, and ISO/IEC 42001 readiness workstreams
 * In your first 90 days you will:

 * Own the weekly vulnerability data pipeline end-to-end (exports * dedup * SLA math * metrics feed)
 * Complete one tooling parity validation with documented, audit-ready evidence
 * Ship one structural remediation with the infrastructure team (e.g., registry lifecycle policies) and verify closure by scan
 * Stand up telemetry on one new cloud environment from zero
 * Step into the second-responder seat: run one incident or tabletop end to end, with documented lessons fed back into the runbooks