Principal Cybersecurity Engineer

As a Cybersecurity Principal Engineer, you will

- Design, implement, and own the Azure Landing Zone security architecture , including:

- Azure Policies and Policy Initiatives

- Guardrails, RBAC models, management groups, and subscription architecture

- Lead implementation and day‑to‑day management of enterprise security platforms, including:

- CrowdStrike (endpoint protection, detection, and response)

- Proofpoint (email security, phishing protection, and threat intelligence)

- Rapid7 (vulnerability management, exposure analytics, and threat detection)

- Checkmarx (SAST, DAST, SCA, code security governance)

- Wiz (CNAPP / CSPM / workload and cloud risk visibility)

- Implement and operationalize Azure Policy for:

- Resource tagging, region restrictions, SKU allowlists

- Encryption, data residency, and compliance guardrails

- Deploy, tune, and manage:

- Microsoft Defender for Cloud (CSPM/CWPP)

- Defender for Identity

- Container and AKS security controls

- Stand up and evolve Microsoft Sentinel (SIEM/SOAR) :

- Data connectors, analytics rules, UEBA

- Threat enrichment and automated response playbooks

- Implement Policy‑as‑Code and Security Baselines‑as‑Code using GitOps practices.

- Maintain enterprise risk register , report security KPIs to leadership, and partner with risk, compliance, and audit teams.

- Run purple‑team style control validation , lead incident response runbooks, and drive post‑incident improvements.

- Establish and govern network security architectures :

- Hub‑spoke / vWAN

- Private Endpoints, Azure Firewall, WAF, DDoS

What would your day look like?

- Partner with Engineering, Network, and Platform teams to design and operate a secure, compliant Azure platform and Snowflake tenant.

- Analyze and audit platform and application codebases using Checkmarx and related tooling to identify vulnerabilities and compliance gaps.

- Act as a security authority on the Architecture Review Board, shaping approved application and cloud design patterns.

- Collaborate with vendors and partners on security assessments and remediation strategies (CrowdStrike, Proofpoint, Rapid7, Wiz).

- Continuously monitor threats and alerts; define SOPs and train L1/L2 teams for effective triage and escalation.

- Drive sprint delivery for security initiatives with high quality and on‑time execution.

Who are we looking for?

- 10+ years of cybersecurity experience with 5+ years focused on Azure cloud security architecture.

- Deep expertise in:

Azure RBAC, Microsoft Entra ID, Conditional Access

PIM / PIM for Groups, Identity Governance

Strong hands‑on experience with:

CrowdStrike, Proofpoint, Rapid7, Checkmarx, Wiz

Defender for Cloud, Microsoft Sentinel, Azure Firewall, WAF

- Proven experience delivering Azure Landing Zones aligned to Microsoft Cloud Adoption Framework and Well‑Architected principles.

- Strong identity federation knowledge (SAML, OAuth2/OIDC), SCIM provisioning, and B2B integrations.

- Automation‑first mindset with PowerShell, Python, Terraform, Bicep, Git, YAML, and CI/CD workflows.

Required Skills:

- Expert‑level Microsoft Entra ID, Conditional Access, PIM, RBAC, and identity governance

- Enterprise‑scale Azure network security and private connectivity design

- Deep experience implementing CNAPP, EDR, email security, vuln management, and code security platforms

- Strong DevSecOps background including SAST/DAST, IaC scanning, and API security

- Mature incident response, observability, and alert tuning experience

- Familiarity with AI/LLM security patterns (Azure OpenAI, RAG architectures)

- Strong experience with Azure network security, including VNet architecture, private endpoints, DDoS, WAF, and Azure Firewall

- Hands-on experience implementing Defender for Cloud, Sentinel SIEM/SOAR, and cloud threat-detection pipelines

- Demonstrated ability to design Azure Policy, policy-as-code, and compliance automation for SOC2/ISO/HIPAA

- Deep understanding of Key Vault, CMK encryption, data protection, and secure data pipelines

- Proven background in DevSecOps, secure CI/CD, IaC (Terraform/Bicep), SAST/DAST, and API security

- Strong capability in observability, logging, alert tuning, and incident response automation

- Experience building secure Azure Landing Zones and enterprise cloud architecture.