Sr Cybersecurity Engineer

About the role

This role serves as the senior subject matter expert for cloud incident response across Microsoft Azure and Microsoft 365. You will lead high‑impact investigations, mentor responders, and continuously improve the speed, quality, and repeatability of cloud incident response operations. This position is ideal for an experienced cloud security engineer, architect, or incident responder who thrives in complex investigations and wants to shape how cloud response is done at scale.

Responsibilities

• Lead Azure and Microsoft 365 security investigations, including identity compromise, privilege escalation, persistence, data exfiltration, and abuse of cloud services
• Act as the senior escalation point for complex cloud investigations, providing investigative direction and response strategy
• Perform investigations using Azure Activity Logs, Entra ID logs, Microsoft 365 Unified Audit Log, Defender telemetry, and related forensic artifacts
• Develop and standardize cloud‑specific incident response playbooks to improve consistency and efficiency
• Stay current with evolving attack techniques and security technologies to design, build, and continuously refine cloud detections and alerts across Azure and Microsoft 365
• Participate in an on‑call rotation as needed to support timely response to security incidents outside of standard business hours

Qualifications

• Extensive hands‑on experience responding to security incidents in Microsoft Azure and/or Microsoft 365
• Functional knowledge of Microsoft Defender, Azure Sentinel and underlying Azure Architecture
• Strong understanding of Azure tenant and subscription architecture, Entra ID identity models, roles, conditional access, and privilege management
• Deep familiarity with cloud logging, telemetry sources, and forensic artifacts, including what is available, how it is acquired, and how attackers attempt to evade it
• Advanced experience writing and optimizing KQL queries for investigation and threat hunting across Defender data sources
• Ability to use Graph API, PowerShell, and automation to acquire evidence, investigate at scale, and accelerate response actions
• Demonstrate strong familiarity with cloud security platforms such as Microsoft Defender and Wiz
• Strong knowledge of the NIST Incident Response Life Cycle and the MITRE ATT&CK Framework
• Experience translating investigations into repeatable response processes, documentation, and improvement opportunities for detection and prevention
• Background