Cloud Security Administrator & Incident Response Lead

Kuvare; Rosemont (IL); On-site; USD 105,000 - 120,000; Full time

Job summary

Kuvare seeks a hands-on Cybersecurity Administrator to join the Information Security team in Rosemont, IL. You will administer, harden, and operate security controls across a hybrid Azure/Microsoft 365 and on‑prem environment, contributing to incident response and cloud/security engineering from day one.

The position requires deep expertise in Microsoft Defender, Sentinel, Entra ID, and automation (PowerShell/Python).

Qualifications

• 3–5+ years IT experience with at least 3 years in cybersecurity.
• Hands-on expertise with Microsoft Defender, Sentinel, Entra ID, and Intune.
• Experience in hybrid cloud security architecture and controls.
• Experience leading security monitoring, incident response, and day-to-day security operations.

Responsibilities

• Operate, tune, and build detections in Microsoft Sentinel and Defender XDR.
• Design and automate incident response with SOAR playbooks.
• Lead hands-on incident response for data breaches, malware, and identity compromises.
• Translate policies into enforceable technical controls with leadership.
• Develop and validate disaster recovery and resilience strategies from a security perspective.

Skills

Sentinel

Defender XDR

SOAR

PowerShell

Python

Bicep/ARM/Terraform

Entra ID

Conditional Access

PIM

Privileged Access

Hybrid identity

Incident response

Vulnerability remediation

Cloud security

Education

Cybersecurity certifications (CEH, OSCP, AZ-500, SC-300, SC-200, SC-100)

Tools

Microsoft Defender

Intune

Sentinel

Entra ID

Job description

Kuvare seeks a hands-on Cybersecurity Administrator to join the Information Security team in Rosemont, IL. You will administer, harden, and operate security controls across a hybrid Azure/Microsoft 365 and on‑prem environment, contributing to incident response and cloud/security engineering from day one.

The position requires deep expertise in Microsoft Defender, Sentinel, Entra ID, and automation (PowerShell/Python).