Principal Cybersecurity Engineer

As a Cybersecurity Principal Engineer, you will

• Design, implement, and own the Azure Landing Zone security architecture, including:

• Azure Policies and Policy Initiatives

• Guardrails, RBAC models, management groups, and subscription architecture

• Lead implementation and day‑to‑day management of enterprise security platforms, including:

• CrowdStrike (endpoint protection, detection, and response)

• Proofpoint (email security, phishing protection, and threat intelligence)

• Rapid7 (vulnerability management, exposure analytics, and threat detection)

• Checkmarx (SAST, DAST, SCA, code security governance)

• Wiz (CNAPP / CSPM / workload and cloud risk visibility)

• Implement and operationalize Azure Policy for:

• Resource tagging, region restrictions, SKU allowlists

• Encryption, data residency, and compliance guardrails

• Deploy, tune, and manage:

• Microsoft Defender for Cloud (CSPM/CWPP)

• Defender for Identity

• Container and AKS security controls

• Stand up and evolve Microsoft Sentinel (SIEM/SOAR):

• Data connectors, analytics rules, UEBA

• Threat enrichment and automated response playbooks

• Implement Policy‑as‑Code and Security Baselines‑as‑Code using GitOps practices.

• Maintain enterprise risk register, report security KPIs to leadership, and partner with risk, compliance, and audit teams.

• Run purple‑team style control validation, lead incident response runbooks, and drive post‑incident improvements.

• Establish and govern network security architectures:

• Hub‑spoke / vWAN

• Private Endpoints, Azure Firewall, WAF, DDoS

What would your day look like?

• Partner with Engineering, Network, and Platform teams to design and operate a secure, compliant Azure platform and Snowflake tenant.

• Analyze and audit platform and application codebases using Checkmarx and related tooling to identify vulnerabilities and compliance gaps.

• Act as a security authority on the Architecture Review Board, shaping approved application and cloud design patterns.

• Collaborate with vendors and partners on security assessments and remediation strategies (CrowdStrike, Proofpoint, Rapid7, Wiz).

• Continuously monitor threats and alerts; define SOPs and train L1/L2 teams for effective triage and escalation.

• Drive sprint delivery for security initiatives with high quality and on‑time execution.

Who are we looking for?

• 10+ years of cybersecurity experience with 5+ years focused on Azure cloud security architecture.

• Deep expertise in:

Azure RBAC, Microsoft Entra ID, Conditional Access

PIM / PIM for Groups, Identity Governance

Strong hands‑on experience with:

CrowdStrike, Proofpoint, Rapid7, Checkmarx, Wiz

Defender for Cloud, Microsoft Sentinel, Azure Firewall, WAF

• Proven experience delivering Azure Landing Zones aligned to Microsoft Cloud Adoption Framework and Well‑Architected principles.

• Strong identity federation knowledge (SAML, OAuth2/OIDC), SCIM provisioning, and B2B integrations.

• Automation‑first mindset with PowerShell, Python, Terraform, Bicep, Git, YAML, and CI/CD workflows.

Required Skills:

• Expert‑level Microsoft Entra ID, Conditional Access, PIM, RBAC, and identity governance

• Enterprise‑scale Azure network security and private connectivity design

• Deep experience implementing CNAPP, EDR, email security, vuln management, and code security platforms

• Strong DevSecOps background including SAST/DAST, IaC scanning, and API security

• Mature incident response, observability, and alert tuning experience

• Familiarity with AI/LLM security patterns (Azure OpenAI, RAG architectures)

• Strong experience with Azure network security, including VNet architecture, private endpoints, DDoS, WAF, and Azure Firewall

• Hands-on experience implementing Defender for Cloud, Sentinel SIEM/SOAR, and cloud threat-detection pipelines

• Demonstrated ability to design Azure Policy, policy-as-code, and compliance automation for SOC2/ISO/HIPAA

• Deep understanding of Key Vault, CMK encryption, data protection, and secure data pipelines

• Proven background in DevSecOps, secure CI/CD, IaC (Terraform/Bicep), SAST/DAST, and API security

• Strong capability in observability, logging, alert tuning, and incident response automation

• Experience building secure Azure Landing Zones and enterprise cloud architecture.