Principal Cybersecurity Engineer

Providence India; Hyderabad; On-site; INR 2,500,000 - 3,200,000; Full time

Job summary

You will leverage CrowdStrike, Proofpoint, Rapid7, Checkmarx, Wiz, and Defender for Cloud/Sentinel to secure cloud workloads, identities, and network perimeters. Strong Azure identity governance and CI/CD security expertise are essential.

Qualifications

• 10+ years in cybersecurity with 5+ years in Azure cloud security architecture.
• Expertise in Azure RBAC, Entra ID, Conditional Access, and identity governance.
• Experience designing CNAPP, EDR, email security, vulnerability mgmt, and code security platforms.
• Strong DevSecOps background with SAST/DAST and IaC scanning.

Responsibilities

• Design, implement, and own Azure Landing Zone security architecture.
• Lead security tooling integration across CrowdStrike, Proofpoint, Rapid7, Checkmarx, Wiz.
• Operate Defender for Cloud, Defender for Identity, and Sentinel SIEM/SOAR pipelines.
• Establish Policy-as-Code, governance, and risk reporting to leadership.
• Drive incident response and post-incident improvements.

Skills

Azure security architecture

Azure RBAC

PIM / Identity governance

CNAPP / EDR / SAST/DAST

DevSecOps / IaC scanning

Incident response & SIEM/SOAR

Security tooling integration

Cloud threat detection

Tools

CrowdStrike

Proofpoint

Rapid7

Checkmarx

Wiz

Microsoft Defender for Cloud

Microsoft Sentinel

Azure Firewall

WAF

Job description

Job Description:

As a Cybersecurity Principal Engineer, you will

• Design, implement, and own the Azure Landing Zone security architecture, including:
• Azure Policies and Policy Initiatives
• Guardrails, RBAC models, management groups, and subscription architecture
• Lead implementation and day‑to‑day management of enterprise security platforms, including:
• CrowdStrike (endpoint protection, detection, and response)
• Proofpoint (email security, phishing protection, and threat intelligence)
• Rapid7 (vulnerability management, exposure analytics, and threat detection)
• Checkmarx (SAST, DAST, SCA, code security governance)
• Wiz (CNAPP / CSPM / workload and cloud risk visibility)
• Implement and operationalize Azure Policy for:
• Resource tagging, region restrictions, SKU allowlists
• Encryption, data residency, and compliance guardrails
• Deploy, tune, and manage:
• Microsoft Defender for Cloud (CSPM/CWPP)
• Defender for Identity
• Container and AKS security controls
• Stand up and evolve Microsoft Sentinel (SIEM/SOAR):
• Data connectors, analytics rules, UEBA
• Threat enrichment and automated response playbooks
• Implement Policy‑as‑Code and Security Baselines‑as‑Code using GitOps practices.
• Maintain enterprise risk register, report security KPIs to leadership, and partner with risk, compliance, and audit teams.
• Run purple‑team style control validation, lead incident response runbooks, and drive post‑incident improvements.
• Establish and govern network security architectures:
• Hub‑spoke / vWAN
• Private Endpoints, Azure Firewall, WAF, DDoS

What would your day look like?

• Partner with Engineering, Network, and Platform teams to design and operate a secure, compliant Azure platform and Snowflake tenant.
• Analyze and audit platform and application codebases using Checkmarx and related tooling to identify vulnerabilities and compliance gaps.
• Act as a security authority on the Architecture Review Board, shaping approved application and cloud design patterns.
• Collaborate with vendors and partners on security assessments and remediation strategies (CrowdStrike, Proofpoint, Rapid7, Wiz).
• Continuously monitor threats and alerts; define SOPs and train L1/L2 teams for effective triage and escalation.
• Drive sprint delivery for security initiatives with high quality and on‑time execution.

Who are we looking for?

• 10+ years of cybersecurity experience with 5+ years focused on Azure cloud security architecture.
• Deep expertise in:
  • Azure RBAC
  • Microsoft Entra ID
  • Conditional Access
  • PIM / PIM for Groups, Identity Governance

Strong Hands‑on Experience With

• CrowdStrike, Proofpoint, Rapid7, Checkmarx, Wiz
• Defender for Cloud, Microsoft Sentinel, Azure Firewall, WAF

Required Skills

• Expert‑level Microsoft Entra ID, Conditional Access, PIM, RBAC, and identity governance
• Enterprise‑scale Azure network security and private connectivity design
• Deep experience implementing CNAPP, EDR, email security, vuln management, and code security platforms
• Strong DevSecOps background including SAST/DAST, IaC scanning, and API security
• Mature incident response, observability, and alert tuning experience
• Familiarity with AI/LLM security patterns (Azure OpenAI, RAG architectures)
• Strong experience with Azure network security, including VNet architecture, private endpoints, DDoS, WAF, and Azure Firewall
• Hands‑on experience implementing Defender for Cloud, Sentinel SIEM/SOAR, and cloud threat‑detection pipelines
• Demonstrated ability to design Azure Policy, policy‑as‑code, and compliance automation for SOC2/ISO/HIPAA
• Deep understanding of Key Vault, CMK encryption, data protection, and secure data pipelines
• Proven background in DevSecOps, secure CI/CD, IaC (Terraform/Bicep), SAST/DAST, and API security
• Strong capability in observability, logging, alert tuning, and incident response automation
• Experience building secure Azure Landing Zones and enterprise cloud architecture.