Cloud Security Specialist

CPX; Abu Dhabi; On-site; AED 120,000 - 170,000; Full time

Job summary

CPX seeks a Cloud Security Operations professional to monitor alerts, run security posture checks and coordinate containment actions across Defender for Cloud, Defender XDR and Sentinel. You will review CSPM findings, triage incidents and drive remediation with ITSM integration.

Requires 5+ years in security operations and Azure/M365 security, with relevant certifications. Some after-hours client-site support may be required.

Qualifications

• 5+ years in security operations or cloud security.
• 2+ years in Azure/Microsoft 365 security.
• Bachelor's degree in CS/IT/Engineering.
• Relevant certifications (AZ-500, SC-200, CCSP).
• Strong communication and client-site availability.

Responsibilities

• Monitor cloud security alerts, posture, and workload protection.
• Operate Defender for Cloud, Defender XDR, Sentinel and related capabilities.
• Review Secure Score and CSPM/CNAPP findings and validate context.
• Triage incidents and coordinate containment actions.
• Track misconfigurations, vulnerabilities, and permissions to closure.
• Support onboarding of subscriptions, workloads and connectors.
• Review service principals, identities and privileged roles.
• Monitor Defender coverage for VM, containers, storage, SQL, Key Vault.
• Integrate cloud alerts with SIEM/SOAR and ITSM workflows.
• Produce dashboards and runbooks; follow incident and change processes.

Skills

Cloud security operations

Azure security

Incident triage

Automation (KQL/PowerShell)

ITSM coordination

Education

Bachelor's in Computer Science / IT / Engineering

Postgraduate information security (advantage)

Tools

Microsoft Defender for Cloud

Defender XDR

Microsoft Sentinel

SIEM/SOAR

Kubernetes security monitoring

Job description

• Monitor cloud security alerts, posture regressions, risky identities, policy failures, connector health and workload protection status.
• Operate Microsoft Defender for Cloud, Defender XDR, Microsoft Sentinel and related cloud security capabilities as assigned.
• Review Secure Score and CSPM/CNAPP findings; validate asset context, severity, exposure and remediation ownership.
• Triage cloud incidents and coordinate containment such as session revocation, Conditional Access action, secret rotation or workload isolation.
• Track misconfigurations, vulnerabilities, exposed services, weak encryption, missing protection and excessive permissions to closure.
• Support onboarding of subscriptions, workloads and cloud connectors; validate telemetry completeness and policy assignment.
• Review service principals, managed identities, privileged roles and access anomalies; elevate high-risk identity findings.
• Monitor Defender plans and agent/extension coverage for VMs, containers, storage, SQL, Key Vault and application services.
• Support container and Kubernetes security monitoring, image risk review and runtime alert triage.
• Integrate and correlate cloud alerts with SIEM/SOAR and ITSM workflows; maintain complete incident and evidence records.
• Perform approved security configuration checks and collect evidence against CIS, Azure benchmarks, UAE IA and ADHICS.
• Produce operational dashboards and reports for alerts, posture, vulnerabilities, identity risks, SLA ageing and exceptions.
• Follow change, incident, problem and exception processes and maintain accurate runbooks and handovers.

Secondary Responsibilities

• Support cloud security architecture reviews, landing-zone validation and DevSecOps security checks.
• Assist with vulnerability assessments, threat hunting and incident lessons learned.
• Support data protection, DLP, IAM/PAM and SaaS security reviews where cloud controls overlap.
• Participate in after-hours support and client-site activities when required.

Skills / Certifications

• AZ-500 Microsoft Azure Security Engineer or equivalent training
• SC-200 Security Operations Analyst
• SC-100, CCSP or CCSK (advantage)
• Security+ or equivalent
• ITIL Foundation (advantage)

Soft skills: Excellent written and verbal communication, Analytical thinking and problem solving, Attention to detail and quality, Accountability and ownership, Teamwork and stakeholder collaboration, Ability to prioritize and meet deadlines, Ability to work at client sites and provide after-hours support when required

5+ years of security operations, cloud operations or infrastructure security experience, including at least 2 years in Azure/Microsoft 365 security.

Education

• Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, Information Systems, Engineering or equivalent.

Postgraduate qualification in information/cyber security is an advantage.

Preferred Skill Set

• Microsoft Defender for Cloud, Sentinel and Defender XDR
• Azure/M365 security posture, identity and workload protection
• Cloud incident triage, vulnerability and remediation tracking
• Kubernetes/container and DevSecOps fundamentals
• KQL, PowerShell or Python automation and ITSM discipline