Staff Azure Platform Security Engineer

Shine; Madrid; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

Shine's Infrastructure & IT unit seeks a Staff Platform Engineer to own Azure cloud security and contribute to multi-cloud strategy. You’ll define architecture, implement controls as code, and partner with platform teams to enforce secure defaults.

You will collaborate with AWS/GCP security and drive CNAPP onboarding, threat modelling, and compliance automation across Europe, with remote/hub options including Madrid.

Qualifications

• 8+ years of infrastructure or security engineering experience, with deep hands‑on Azure security expertise at production scale.
• Ability to operate at staff level — technical authority, cross‑team influence, and sound judgment.
• Strong Entra ID security expertise: conditional access, PIM, workload identity, federation hardening.
• Proven experience implementing Azure security controls: Defender for Cloud, Sentinel, Azure Policy, network security, Key Vault.
• Infrastructure‑as‑code for security (Terraform) — policy‑as‑code, security modules, CI/CD integration.
• Threat modelling capability — reasoning about cloud attack paths, privilege escalation, and lateral movement.
• Practical compliance framework implementation (ISO 27001, GDPR, DORA, or similar).
• CNAPP/CSPM tooling experience (Wiz, Cortex Cloud, Orca, Prisma Cloud, Defender CSPM).
• Familiarity with observability platforms.
• Working knowledge of at least one other CSP (AWS or GCP) from a security perspective.
• Security detection experience with a SIEM (CrowdStrike, Splunk, Elastic, Sentinel).
• Ability to influence without authority — setting standards across teams.
• Excellent technical communication in English.

Responsibilities

• Define security architecture for Azure estate — policy guardrails, network security, encryption, identity hardening, and secure defaults.
• Own the security of our Azure landing zone — secure platform, migration readiness and posture validation.
• Own Entra ID security — conditional access, PIM, workload identity governance, federation hardening with Okta.
• Co‑own CNAPP onboarding — posture management policies, prioritisation, and workflow integration.
• Build and maintain security controls as code using Terraform and Azure Policy — CIS baselines, automated remediation, CI/CD integration.
• Ensure on‑prem → Azure migrations happen securely — risk assessment, controls during, posture validation post.
• Threat modelling for Azure infrastructure designs to identify attack paths and prioritise controls.
• Automate compliance evidence collection for ISO 27001, GDPR, and DORA.
• Align Azure security patterns with AWS and GCP for cohesive multi‑cloud posture.
• Enable teams: security design reviews, paved‑road patterns, documentation, and office hours.

Skills

Azure security

Staff leadership

Entra ID

Defender for Cloud

Sentinel

Azure Policy

Key Vault

Terraform

CI/CD

Threat modelling

ISO 27001

GDPR

DORA

CNAPP/CSPM

AWS/GCP security

SIEM

Communication in English

Tools

Wiz

Cortex Cloud

Orca

Prisma Cloud

Defender CSPM

Job description

Shine's Infrastructure & IT unit seeks a Staff Platform Engineer to own Azure cloud security and contribute to multi-cloud strategy. You’ll define architecture, implement controls as code, and partner with platform teams to enforce secure defaults.

You will collaborate with AWS/GCP security and drive CNAPP onboarding, threat modelling, and compliance automation across Europe, with remote/hub options including Madrid.