Senior Information Cloud Security Engineer

nrf; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

Norton Rose Fulbright is a global law firm seeking a Senior Information Security Engineer to secure cloud platforms, AI solutions, and related identities, data, and integrations. You will lead cloud and AI security assessments, define secure architecture patterns, and improve posture across Azure, AWS, SaaS, and enterprise tech.

The role combines hands-on cloud security engineering with governance, working with architects, platform teams, and service owners to apply guardrails across the

Qualifications

• Senior information security engineer with hands-on cloud security experience across Azure/AWS and cloud-native services.
• Experience translating security requirements into practical, scalable controls.
• Proficient in automation and scripting (PowerShell, Python) and IaC tools.

Responsibilities

• Define and improve security controls across Azure, AWS, cloud-native services, SaaS platforms, containers and serverless workloads.
• Lead cloud security assessments and secure architecture patterns.
• Automate control validation and provide risk-based recommendations to stakeholders.
• Embed security into cloud engineering and delivery practices with architects and developers.
• Develop monitoring and governance processes for cloud and AI security.

Skills

Cloud security

Azure

AWS

Python

PowerShell

Tools

Terraform

KQL

APIs

Job description

Practice Group / Department: IT Security - Operations and Risk

Job Description

Norton Rose Fulbright is a global law firm with more than 3,000 lawyers advising clients across locations in the United States, Europe, Canada, Latin America, Asia, Australia, Africa and the Middle East. We provide a full scope of legal services to the world's preeminent corporations and financial institutions.

Our vision is to be a world class business, profitable, ambitious, cooperative and considerate, supporting our clients and people through our global business principles of Quality, Unity and Integrity.

We apply our business principles to all our activities world-wide. They describe our culture and personality both internally and externally, the way we work and what we stand for.

The Role

The Senior Information Security Engineer is a senior technical role within the Global Information Security function, focused on securing cloud platforms, cloud-native services, artificial intelligence solutions, and the identities, data, applications, and integrations that support them. The role works across Azure, GCP, SaaS, AI platforms, and enterprise technology to translate security requirements into practical, scalable, and supportable controls.

The role combines hands-on cloud security engineering with technical governance. The successful candidate will lead cloud and AI security assessments, define secure architecture patterns, improve posture and monitoring, investigate complex security issues, automate control validation, and provide clear risk-based recommendations to technical and senior stakeholders.

The Team

The Global Information Security team delivers strategic and operational improvements that strengthen the Firm's security posture. The team works across regions and technology functions to define security standards, improve visibility, manage cyber risk, and ensure that cloud and enterprise services are securely designed, implemented, monitored, and continuously improved.

Key Responsibilities

Cloud Platform, Identity & Workload Security

• Define and continuously improve security controls and reference patterns across Azure, AWS, cloud-native services, SaaS platforms, containers, serverless workloads, virtual machines, storage, databases, APIs, and supporting network services.
• Assess cloud architectures and configurations for identity, network exposure, encryption, secrets management, key management, logging, resilience, data protection, and secure administrative access.
• Lead technical investigations involving cloud identities, service principals, managed identities, workload identities, API permissions, privileged access, exposed services, misconfiguration, and suspicious cloud activity.
• Embed security into cloud engineering and delivery practices by working with architects, platform teams, developers, and service owners to apply secure-by-design guardrails throughout the technology lifecycle.

Cloud Posture, Exposure & Security Assurance

• Own and improve cloud security posture and workload-protection processes, including platform onboarding, control baselining, finding validation, risk prioritization, remediation tracking, exception handling, and integration with governance processes.
• Support vulnerability and exposure management across internet-facing assets, cloud workloads, applications, containers, and SaaS services using available posture, vulnerability, attack-surface, and threat data.
• Perform security reviews of cloud solutions, integrations, APIs, infrastructure-as-code, and technology changes, with emphasis on least privilege, segmentation, encryption, logging, auditability, secure configuration, and operational ownership.

AI Security, Automation & Engineering

• Define and apply security requirements for enterprise AI, generative AI, copilots, agents, machine-learning services, and AI-enabled SaaS solutions, including data access, prompt and response handling, model or service permissions, identity, logging, retention, and human oversight.
• Assess AI-specific threats and control gaps, including prompt injection, sensitive-data leakage, insecure agent actions, excessive permissions, unapproved integrations, third-party model risk, and inadequate monitoring; translate findings into proportionate safeguards.
• Build automation and proof-of-concept solutions using PowerShell, Python, KQL, APIs, policy-as-code, infrastructure-as-code, cloud-native functions, and workflow technologies, and mature successful concepts into governed, supportable services.

Monitoring, Governance, Reporting & Leadership

• Define security-telemetry and detection requirements for cloud and AI services, and work with monitoring teams to ensure relevant identity, administrative, data-access, workload, and application activity is available for investigation and response.
• Develop and maintain cloud and AI security standards, architecture patterns, technical procedures, assessment methodologies, runbooks, and control-validation processes.