Cloud Security Engineer (DED)

The ideal candidate is a Cloud Security Engineer with deep Azure, Sentinel, Defender for Cloud, and KQL expertise who has specifically built data exfiltration detection capabilities and implemented cloud security controls at an enterprise scale.

Deploy Microsoft Defender for Cloud protections (Key Vault, Storage, Databases, AI, API) across several Azure tenants using Azure Policy and Policy-as-Code pipelines. Centralize logging in Microsoft Sentinel by turning on audit and resource logs and connecting Azure, M365 and AWS. Build and tune exfiltration detections in KQL that flag unusual data volumes, rate changes and abnormal access patterns across M365, PaaS and SaaS services.

Detect exfiltration from Azure IaaS workloads by: enabling Defender for Servers and VNet/NSG flow logs with Traffic Analytics; using Firewall logs to baseline normal outbound traffic; alerting on large or unusual transfers to the internet or unknown destinations. Map exfiltration paths to controls and document coverage gaps and recommendations. Create triage playbooks and runbooks with clear escalation paths, then hand them over to the InfoSec/SOE team.

Required Skills 5+ years in cloud security engineering, including at least 3 years of hands-on Azure work. Being able to map exfiltration points to controls and document coverage gaps, such as exfiltration through legitimate native features. To be able to build and test custom Sentinel exfiltration detections in KQL .

These should cover unu