Requirements
Monitor cloud security alerts, posture regressions, risky identities, policy failures, connector health, and workload protection status. Operate Microsoft Defender for Cloud, Defender XDR, Microsoft Sentinel, and related cloud security capabilities. Review Secure Score and CSPM/CNAPP findings, triage cloud incidents, and track misconfigurations and vulnerabilities to closure. Support onboarding of subscriptions, workloads, and cloud connectors. Review service principals, managed identities, and privileged roles. Monitor Defender plans and agent/extension coverage. Support container and Kubernetes security monitoring. Integrate and correlate cloud alerts with SIEM/SOAR and ITSM workflows. Perform security configuration checks against benchmarks. Produce operational dashboards and reports. Follow change, incident, problem, and exception processes. Support cloud security architecture reviews, landing-zone validation, and DevSecOps security checks. Assist with vulnerability assessments, threat hunting, and incident lessons learned. Support data protection, DLP, IAM/PAM, and SaaS security reviews. Participate in after-hours support and client-site activities.
Description
Primary ResponsibilitiesMonitor cloud security alerts, posture regressions, risky identities, policy failures, connector health and workload protection status.Operate Microsoft Defender for Cloud, Defender XDR, Microsoft Sentinel and related cloud security capabilities as assigned.Review Secure Score and CSPM/CNAPP findings; validate asset context, severity, exposure and remediation ownership.Triage cloud incidents and coordinate containment such as session revocation, Conditional Access action, secret rotation or workload isolation.Track misconfigurations, vulnerabilities, exposed services, weak encryption, missing protection and excessive permissions to closure.Support onboarding of subscriptions, workloads and cloud connectors; validate telemetry completeness and policy assignment.Review service principals, managed identities, privileged roles and access anomalies; escalate high-risk identity findings.Monitor Defender plans and agent/extension coverage for VMs, containers, storage, SQL, Key Vault and application services.Support container and Kubernetes security monitoring, image risk review and runtime alert triage.Integrate and correlate cloud alerts with SIEM/SOAR and ITSM workflows; maintain complete incident and evidence records.Perform approved security configuration checks and collect evidence against CIS, Azure benchmarks, UAE IA and ADHICS.Produce operational dashboards and reports for alerts, posture, vulnerabilities, identity risks, SLA ageing and exceptions.Follow change, incident, problem and exception processes and maintain accurate runbooks and handovers.Secondary ResponsibilitiesSupport cloud security architecture reviews, landing-zone validation and DevSecOps security checks.Assist with vulnerability assessments, threat hunting and incident lessons learned.Support data protection, DLP, IAM/PAM and SaaS security reviews where cloud controls overlap.Participate in after-hours support and client-site activities when required.Skills / CertificationsAZ-500 Microsoft Azure Security Engineer or equivalent trainingSC-200 Security Operations AnalystSC-100, CCSP or CCSK (advantage)Security+ or equivalentITIL Foundation (advantage)Soft skills: Excellent written and verbal communication, Analytical thinking and problem solving, Attention to detail and quality, Accountability and ownership, Teamwork and stakeholder collaboration, Ability to prioritize and meet deadlines, Ability to work at client sites and provide after-hours support when requiredMinimum Work Experience5+ years of security operations, cloud operations or infrastructure security experience, including at least 2 years in Azure/Microsoft 365 security.EducationBachelor's degree in Computer Science, Cybersecurity, Information Technology, Information Systems, Engineering or equivalent.Postgraduate qualification in information/cyber security is an advantage.Preferred Skill SetMicrosoft Defender for Cloud, Sentinel and Defender XDRAzure/M365 security posture, identity and workload protectionCloud incident triage, vulnerability and remediation trackingKubernetes/container and DevSecOps fundamentalsKQL, PowerShell or Python automation and ITSM discipline