As a Cybersecurity Principal Engineer, you will
- Design, implement, and own the Azure Landing Zone security architecture, including:
- Azure Policies and Policy Initiatives
- Guardrails, RBAC models, management groups, and subscription architecture
- Lead implementation and day‑to‑day management of enterprise security platforms, including:
- CrowdStrike (endpoint protection, detection, and response)
- Proofpoint (email security, phishing protection, and threat intelligence)
- Rapid7 (vulnerability management, exposure analytics, and threat detection)
- Checkmarx (SAST, DAST, SCA, code security governance)
- Wiz (CNAPP / CSPM / workload and cloud risk visibility)
- Implement and operationalize Azure Policy for:
- Resource tagging, region restrictions, SKU allowlists
- Encryption, data residency, and compliance guardrails
- Deploy, tune, and manage:
- Microsoft Defender for Cloud (CSPM/CWPP)
- Defender for Identity
- Container and AKS security controls
- Stand up and evolve Microsoft Sentinel (SIEM/SOAR):
- Data connectors, analytics rules, UEBA
- Threat enrichment and automated response playbooks
- Implement Policy‑as‑Code and Security Baselines‑as‑Code using GitOps practices.
- Maintain enterprise risk register, report security KPIs to leadership, and partner with risk, compliance, and audit teams.
- Run purple‑team style control validation, lead incident response runbooks, and drive post‑incident improvements.
- Establish and govern network security architectures:
- Hub‑spoke / vWAN
- Private Endpoints, Azure Firewall, WAF, DDoS
What would your day look like?
- Partner with Engineering, Network, and Platform teams to design and operate a secure, compliant Azure platform and Snowflake tenant.
- Analyze and audit platform and application codebases using Checkmarx and related tooling to identify vulnerabilities and compliance gaps.
- Act as a security authority on the Architecture Review Board, shaping approved application and cloud design patterns.
- Collaborate with vendors and partners on security assessments and remediation strategies (CrowdStrike, Proofpoint, Rapid7, Wiz).
- Continuously monitor threats and alerts; define SOPs and train L1/L2 teams for effective triage and escalation.
- Drive sprint delivery for security initiatives with high quality and on‑time execution.
Who are we looking for?
- 10+ years of cybersecurity experience with 5+ years focused on Azure cloud security architecture.
- Deep expertise in:
Azure RBAC, Microsoft Entra ID, Conditional Access
PIM / PIM for Groups, Identity Governance
Strong hands‑on experience with:
CrowdStrike, Proofpoint, Rapid7, Checkmarx, Wiz
Defender for Cloud, Microsoft Sentinel, Azure Firewall, WAF
- Proven experience delivering Azure Landing Zones aligned to Microsoft Cloud Adoption Framework and Well‑Architected principles.
- Strong identity federation knowledge (SAML, OAuth2/OIDC), SCIM provisioning, and B2B integrations.
- Automation‑first mindset with PowerShell, Python, Terraform, Bicep, Git, YAML, and CI/CD workflows.
Required Skills:
- Expert‑level Microsoft Entra ID, Conditional Access, PIM, RBAC, and identity governance
- Enterprise‑scale Azure network security and private connectivity design
- Deep experience implementing CNAPP, EDR, email security, vuln management, and code security platforms
- Strong DevSecOps background including SAST/DAST, IaC scanning, and API security
- Mature incident response, observability, and alert tuning experience
- Familiarity with AI/LLM security patterns (Azure OpenAI, RAG architectures)
- Strong experience with Azure network security, including VNet architecture, private endpoints, DDoS, WAF, and Azure Firewall
- Hands-on experience implementing Defender for Cloud, Sentinel SIEM/SOAR, and cloud threat-detection pipelines
- Demonstrated ability to design Azure Policy, policy-as-code, and compliance automation for SOC2/ISO/HIPAA
- Deep understanding of Key Vault, CMK encryption, data protection, and secure data pipelines
- Proven background in DevSecOps, secure CI/CD, IaC (Terraform/Bicep), SAST/DAST, and API security
- Strong capability in observability, logging, alert tuning, and incident response automation
- Experience building secure Azure Landing Zones and enterprise cloud architecture.