Cloud Security Engineer (m/f/d)

Contract

Client

Role Summary

Key Responsibilities

• Serve as the hands-on technical engineer for Microsoft security stack deployment and cutover activities.
• Deploy and configure Microsoft Defender for Cloud (workload protections, secure score, compliance dashboards) and Microsoft Sentinel (analytics rules, KQL queries, workbooks, playbooks).
• Implement Azure Policy (custom initiatives, assignments, exemptions, remediation) and network security controls (NSGs, Azure Firewall, Private Endpoints, WAF, DDoS).
• Coordinate directly with:
• Government end client IT & security teams
• Internal cloud architects and delivery teams
• Third-party security tool vendors
• Presales and delivery leadership
• Configure and manage Entra ID security including Conditional Access policies, Privileged Identity Management (PIM), identity governance, and service principals/managed identities.
• Implement Microsoft Purview controls (DLP policies, sensitivity labels, retention) and encryption via Azure Key Vault, disk encryption, and TLS.
• Support migration of applications across domains or Entra ID tenants, implementing security controls for migrated workloads.
• Integrate and manage third-party security tools with the Microsoft stack, ensuring logging and monitoring feed into Sentinel.
• Monitor and respond to alerts from Defender for Cloud, Sentinel, and M365 Defender; perform triage and escalation.

Required Technical Expertise

• Minimum 5–6 years of experience in IT/security, with at least 3 years in hands-on Azure security engineering.
• Deep knowledge of Microsoft security stack:
• Microsoft Defender for Cloud
• Microsoft Sentinel (KQL, analytics rules, workbooks, playbooks)
• Azure Policy (custom initiatives, assignments, remediation)
• Entra ID (Conditional Access, PIM, identity governance, service principals)
• Microsoft Purview (DLP, sensitivity labels, retention)
• Azure Key Vault (secrets, keys, certificates)
• Understanding of:
• Network security controls (NSGs, Azure Firewall, Private Endpoints, WAF, DDoS)
• Domain-to-domain or tenant-to-tenant migration
• Data encryption (disk encryption, TLS)
• Third-party security tool integration
• Proven track record in cloud security deployment or migration projects involving government or regulated environments.
• Experience with Infrastructure-as-Code (Terraform or Bicep) preferred but not mandatory.

Preferred Certifications

• Microsoft AZ-500 (Azure Security Engineer Associate) – strongly preferred

• Microsoft SC-200 (Security Operations Analyst)

• Microsoft SC-300 (Identity and Access Administrator)

Halian Group