MatchPoint Jobs Hiring Now

Technical Skills

• Microsoft Azure
• Microsoft Defender for Cloud
• Microsoft Sentinel (SIEM/SOAR)
• Microsoft Entra ID (Azure AD)
• Azure Firewall, NSGs, WAF, DDoS Protection
• Azure Key Vault
• Azure Policy & Azure Landing Zones
• Identity and access management (IAM), Conditional Access & Privileged Identity Management (PIM)
• Terraform, ARM Templates, Bicep
• PowerShell, Azure CLI
• GitHub Actions or Azure DevOps
• VPN, ExpressRoute, Private Link
• Vulnerability Management
• Incident Response & Threat Detection
• Zero Trust Architecture

CLOUD SECURITY ENGINEER

Your responsibilities:

• Support the design and implementation of Azure landing zone controls, identity, and network guardrails (VNet, NSGs, private endpoints) as directed by Ardent Mills security leadership.
• Configure and tune cloud-native security services (Microsoft Sentinel, Defender XDR).
• Configure and tune Microsoft Defender for Cloud Apps (CASB) — connected apps, policies, session controls, and real-time monitoring integrations (e.g., Power Platform / citizen developer governance).
• Perform Cloud Security Posture Management (CSPM) assessments against CIS Azure Foundations Benchmark and Microsoft Cloud Security Benchmark (MCSB), and deliver prioritized remediation plans.
• Execute tooling onboarding and configuration for in-scope cloud security tools as directed, including baseline setup, policy configuration, and integration.
• Build and deploy Azure Policy initiatives, policy-as-code, and automated remediation to reduce configuration drift.
• Implement key management, encryption at rest/in transit, and certificate governance using Azure Key Vault.
• Configure logging, telemetry, and alerting (Azure Monitor, Log Analytics) integrated with SIEM/XDR; validate detection coverage.
• Harden serverless, containers, and managed services (Functions, Logic Apps, Container Apps, AKS, ACI) using established baselines.
• Perform threat modeling and security reviews for specific in-scope cloud architectures and application designs.
• Deliver IaC guardrails (Terraform/Bicep/ARM), image baselines, and vulnerability workflows in partnership with platform teams.
• Support cloud incident triage and containment activities as needed during the engagement (not on-call escalation owner).
• Document standards, runbooks, and configurations to enable knowledge transfer to full-time staff at engagement close.

Key deliverables:

• CSPM assessment report against CIS Azure Foundations / MCSB with prioritized, risk-ranked remediation plan.
• Defender for Cloud Apps (CASB) configuration baseline — connected apps, policy set, session controls, and monitoring integrations documented.
• Azure Policy Initiative library aligned to Ardent Mills governance requirements.
• Resource standards baseline (tagging, naming, region restrictions, diagnostic settings).
• Key Vault governance standard and implementation.
• Defender for Cloud posture improvement plan with measurable secure score uplift.
• Tooling onboarding and configuration runbooks for in-scope cloud security tools.
• Secure reference architecture(s) for in-scope workloads.
• Detection coverage matrix mapped to MITRE ATT&CK for cloud.
• Infrastructure drift monitoring framework and remediation playbooks.
• Documentation package for knowledge transfer at end of engagement.

Essential skills and experience:

• 4–7 years of hands-on cloud security engineering experience, primarily Microsoft Azure.
• Demonstrated experience delivering Azure Policy, IaC guardrails, and CSPM/CWPP outcomes on prior engagements.
• Hands-on experience configuring Microsoft Defender for Cloud Apps (CASB) or an equivalent CASB solution.
• Experience performing posture assessments against CIS Benchmarks and/or Microsoft Cloud Security Benchmark.
• Strong knowledge of IAM, networking, encryption, and cloud-native security tooling.
• Experience securing hybrid environments spanning on-premises and Azure.
• Scripting/automation expertise (KQL, Python/Bash/PowerShell; Terraform/Bicep/ARM).
• Certifications: Azure Security Engineer Associate (AZ-500) required; CCSP or equivalent preferred.
• Ability to work independently with minimal ramp-up and deliver against defined milestones.