Security Consultant

Shakers; Lisboa; Hybrid; EUR 70,000 - 110,000; Full time

Job summary

Shakers is seeking a Lead Cloud Security Consultant focused on Microsoft stack to join a European tech group. This client-facing role involves delivering cloud security engagements end to end, with emphasis on Sentinel, Defender XDR, Defender for Cloud, and Entra ID.

You will craft detection rules and walk customers through telemetry and risk. The ideal candidate has 5–6 years of cybersecurity experience, strong Microsoft security background, and fluent Portuguese and English.

Qualifications

• 5–6 years of cybersecurity experience with Microsoft security stack in delivery/consulting roles.
• Production experience with Microsoft Sentinel, writing KQL and workbooks.
• Fluent Portuguese and English language skills.

Responsibilities

• Deliver end-to-end cloud security engagements: Sentinel, Defender XDR, Defender for Cloud.
• Write KQL, tune analytics rules, build connectors, and explain telemetry and risks to customers.
• Assess and improve controls across Sentinel, Defender XDR, Defender for Cloud, Entra ID and cloud workloads.
• Support multi-cloud engagements on Google Cloud and AWS; CNAPP work.
• Run customer workshops and build reusable assets: playbooks, templates, KQL libraries, detection rule packs.

Skills

Cloud security

KQL

Threat hunting

Incident response

Azure security

Defender XDR

Sentinel

Identity security

RBAC

Least privilege

CNAPP

Multi-cloud

Workshop facilitation

Tools

Logic Apps

Playbooks

Defender XDR

Job description

We are hiring a Lead Cloud Security Consultant with a Microsoft focus for a leading European technology group, through Shakers. This is a client facing consulting role.

What you will do

• Deliver cloud security engagements end to end: Sentinel deployments, Defender XDR rollouts, Defender for Cloud implementations, detection engineering, threat hunting, incident response support, posture assessments, Azure security reviews, identity security improvements and cloud hardening.
• Write KQL, tune analytics rules, build connectors and configure Defender XDR policies, and walk customers through what their telemetry, posture, exposure and risks mean.
• Assess and improve controls across Sentinel, Defender XDR, Defender for Cloud, Entra ID, Azure workloads, logging and privileged access.
• Support multi-cloud engagements on Google Cloud and AWS and CNAPP related work.
• Run customer workshops and build reusable assets: playbooks, deliverable templates, KQL libraries, detection rule packs, configuration baselines, hardening guides and remediation roadmaps.

What you need

• 5 to 6 years of cybersecurity experience or more, including relevant work on the Microsoft security stack in a delivery, consulting, cloud security, detection engineering or senior SOC role.
• Microsoft Sentinel deployed or supported in production for at least one enterprise customer, writing KQL from scratch for analytics rules, hunting queries and workbooks, working with data connectors and with automation rules or Logic Apps playbooks.
• Defender XDR configured and operated across Endpoint, Identity, Office 365 and Cloud Apps, with advanced hunting.
• Hands‑on with Microsoft Defender for Cloud: recommendations, regulatory compliance, workload protection and posture management.
• Strong Microsoft Entra ID security: MFA, Conditional Access, Identity Protection, access reviews, enterprise applications and service principals. Familiarity with PIM, RBAC and least privilege.
• Understanding of CSPM, CWPP, attack paths and cloud specific attack patterns.
• Experience delivering client facing work and producing clear technical deliverables.
• Portuguese and English.

Nice to have

• SC-100 is strongly valued. SC-200, AZ-500, SC-300, SC-400, CISSP, CCSP, Google Cloud Professional Cloud Security Engineer or AWS Security Specialty are also valued.
• Microsoft Purview, Wiz or another CNAPP platform, Infrastructure‑as‑Code security, DevSecOps, and knowledge of Microsoft Cloud Security Benchmark, CIS Benchmarks, NIST, ISO 27001 or MITRE ATT&CK.

Full time, long term. Hybrid, 2 to 3 days per week on site, Lisbon.