REMOTE - Sr. Security Engineer - Cloud Security & Detection

Job Description Summary

The Sr. Security Engineer, Cloud Security & Detection designs, deploys, and operates cloud security posture, data protection, and detection and response capability for Fortellar's clients, with primary assignment to large-scale, multi-workstream security remediation engagements. The role is typically responsible for closing the largest single pool of open findings in the client estate, and for transitioning detection and data security capability off incumbent external vendors and onto the Microsoft platform the client already licenses. Engagements involve cloud estates carrying substantial backlogs of open posture findings, together with Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Defender XDR, and Microsoft Purview.

This is a hands-on engineering role with direct client exposure. The engineer is accountable for standing up a detection capability that must be proven equivalent to an incumbent managed service before that service is decommissioned, and for clearing an incident backlog in an environment where no response process previously operated. The role requires deep Azure and Microsoft security platform expertise, real incident response experience, strong verbal and written communication, and the professional presence to represent Fortellar credibly in front of client technical staff and executives, both in person and virtually.

Must be able to travel 10% - 20% to client sites

Cloud Security Posture Engineering

• Assign a named owner and a closure date to every open cloud finding, and review all standing exemptions, revoking those without a written rationale and an expiry date.
• Eliminate anonymous and public access from internet-facing cloud resources, including enabling authentication on function applications and removing public access from storage accounts.
• Rotate and remove verified secrets embedded in cloud resources, and disable shared-key access across storage accounts, prioritizing those holding sensitive data.
• Establish private link connectivity, network rules, and network security group coverage as platform standards, and adopt managed identity for web applications and functions.
• Route diagnostic and platform logging into Microsoft Sentinel, and manage ingestion scope and cost against the agreed platform budget.
• Implement landing-zone guardrails as policy-as-code so that remediated configuration cannot regress, and review identified attack paths on a monthly cadence.

Security Operations and Incident Response

• Triage and close the standing backlog of high-severity security incidents, establishing disposition and evidence for each.
• Author and publish the incident response plan, severity matrix, and escalation path, and define “incident” for ratified policy, including insurer and regulatory notification triggers.
• Enforce remediation tracking so that every finding carries an owner and a disposition, and complete mail-flow, quarantine, and anti-impersonation configuration.
• Facilitate cross-functional response during critical incidents, including client technical staff, executives, and third-party providers.
• Define and test monitoring coverage hours and the out-of-hours escalation path, establish a threat hunting cadence, and facilitate tabletop exercises with client stakeholders.

Detection Engineering and Automation

• Build and tune Microsoft Sentinel analytics rules, watchlists, and workbooks, and manage data connectors and detection coverage against a defined threat model.
• Produce the technical evaluation supporting the managed detection sourcing decision, then transition detection onto the chosen platform, running the incumbent service in parallel until the replacement is demonstrably equivalent.
• Design and deploy automated and agentic response playbooks for the highest-volume alert types, with scoped credentials, no standing privilege, and a named human approving any containment that affects production.
• Direct efforts to reduce alert volume and mean time to resolution through tuning, automation, and suppression of validated false positives.
• Evaluate emerging tooling and AI-driven detection and response capability for applicability to client and internal operations.

Change Management and Operational Safety

• Design and operate pilot rings and staged rollouts for every change capable of disrupting access or production workloads.
• Prepare, submit, and present change records to the client's change process, including risk, blast radius, validation steps, and backout plan.
• Execute change during scheduled maintenance windows, including evenings and weekends where the change cannot safely be made during business hours.
• Halt or defer a rollout where validation is incomplete and communicate that decision and its schedule consequence to the engagement lead and the client without delay.

Experience and Education

• Bachelor’s degree in Computer Science, Information Security or a related field
• Preferred certifications: AZ-500, SC-200, SC-100, CCSP or CISSP
• 8+ years in infrastructure or security engineering, including 5+ years securing Azure environments
• 4+ years building and tuning Microsoft Sentinel detections (KQL), including Defender XDR and Defender for Cloud
• Hands-on incident response experience, including leading response to critical incidents
• Experience with policy-as-code (Azure Policy, Terraform or Bicep), Microsoft Purview and security automation (Logic Apps or Sentinel playbooks)
• 3+ years in a client-facing consulting role, presenting to technical and executive stakeholders
• Track record of leading high-risk changes through formal change management, using pilots, staged rollouts and rollback plans

This role is open only to candidates who currently live and are authorized to work in the United States. Applications must be submitted from within the U.S. Applications submitted from a location that does not match the candidate’s stated location will not be considered.