Cloud Security Engineer (Azure)

About the role

The Cloud Security Engineer (Azure) will support DOCOsoft’s cloud security operations and help strengthen the security posture of our Azure‑hosted SaaS platform. You will work closely with engineering teams to embed security‑by‑design as we expand our Azure footprint.

Key responsibilities

• Administer and optimise Microsoft Defender (Cloud, Identity, Endpoint) and Azure‑native security tools; manage identity and access with Conditional Access, Entra ID Governance, and PIM.
• Maintain hardening standards for Azure resources (Key Vault, Storage, App Services, VMs, networking) and improve Azure Secure Score in line with ISO 27001.
• Support secure design and review of Azure PaaS/IaaS workloads, advise on network security, API protection, encryption, segmentation and Zero Trust, and conduct threat modelling.
• Integrate security into CI/CD pipelines and GitHub workflows; assess Terraform/Bicep IaC, enforce policy‑as‑code (Azure Policy, GitHub Advanced Security) and implement automated guardrails.
• Identify and remediate cloud vulnerabilities, support internal/external audits, maintain compliance documentation and contribute to third‑party risk assessments.
• Enhance monitoring with Azure Monitor, Log Analytics and Sentinel; develop KQL queries, dashboards and detection rules, investigate alerts and manage incident response playbooks.

Required profile

• Bachelor’s degree in Computer Science, Engineering or a related field.
• 4+ years of Azure cloud engineering experience, including at least 2 years in Azure security engineering.
• Relevant certifications such as AZ‑500, SC‑200 or SC‑100 are desirable.
• Familiarity with ISO 27001, SOC 2, GDPR and cloud security best practices.

Required skills

• Microsoft Defender for Cloud, Azure Sentinel, Entra ID, Key Vault, Azure Firewall, WAF, NSGs.
• Kusto Query Language (KQL) for log analysis and threat hunting.
• Azure networking, identity, encryption and governance concepts.
• Infrastructure‑as‑Code security with Bicep (Terraform acceptable) and Azure Policy.
• DevSecOps practices, CI/CD integration, GitHub workflows and policy‑as‑code.