Cloud Security Engineer

Insight Global; Wilmington (DE); On-site; USD 130,000 - 195,000; Full time

Job summary

Insight Global is hiring a hands-on Cloud Security Engineer in Wilmington, DE to strengthen the SOC's ability to detect, investigate, and respond to threats across Azure and AWS.

The role serves as the cloud security SME, leading incident response, improving detections, and automating response actions across cloud environments. Extensive experience in cloud security and incident management is required.

Qualifications

• Over 10 years in cybersecurity with at least 5 years in Azure and/or AWS cloud security.
• Hands-on SOC, IR, detection and response for cloud incidents.
• Strong knowledge of Azure services (Entra ID, RBAC, storage, Key Vault, networking) and AWS services (IAM, S3, EC2, VPC, CloudTrail).
• Experience with Defender for Cloud, CrowdStrike SaaS Shield, or Wiz.
• Writing KQL queries and investigating cloud identity attacks, privilege escalation, exfiltration.

Responsibilities

• Investigate threats across Azure and AWS and lead technical incident response with cloud teams.
• Triaging alerts from Defender for Cloud, CrowdStrike Next-Gen SIEM, Wiz, GuardDuty, Security Hub, and related tools.
• Investigate cloud attacks involving compromised identities, privilege escalation, persistence, and data exfiltration.
• Lead containment, credential rotation, access restriction, workload isolation, and evidence preservation.
• Build and tune cloud detections using KQL and improve Azure/AWS telemetry.
• Develop automated response playbooks for common cloud security incidents.
• Review high-risk cloud exposures and coordinate remediation with SOC and MDR/MSSP teams.

Skills

Azure cloud security

AWS cloud security

Incident response

Cloud threat hunting

Scripting (Python/PowerShell)

Tools

Microsoft Defender for Cloud

CrowdStrike SaaS Shield

Wiz

GuardDuty

Security Hub

Azure CLI

AWS CLI

Terraform

KQL

Job description

Job Description

We are seeking a hands-on Cloud Security Engineer to strengthen the SOC's ability to detect, investigate, and respond to threats across Azure and AWS.

This person will serve as the SOC's cloud security subject matter expert, investigating suspicious activity across cloud identities, workloads, storage, and data services. They will lead technical incident response alongside cloud administrators and application owners, improve detection coverage, and automate common response actions.

Key Responsibilities

• Serve as the SOC's cloud security SME, investigating and responding to security threats across Azure and AWS.


• Triage alerts from Microsoft Defender for Cloud, CrowdStrike Next-Gen SIEM, Wiz, AWS GuardDuty, Security Hub, and related tools, distinguishing true threats from misconfigurations and false positives.


• Investigate cloud attacks involving compromised identities, privilege escalation, persistence, unauthorized access, data exfiltration, and resource abuse using Azure/AWS logs and telemetry.


• Lead technical incident response and recovery, including containment, credential/key rotation, access restriction, workload isolation, evidence preservation, and validation that attacker access has been removed.


• Build and tune cloud detections using KQL and improve logging/telemetry coverage across Azure and AWS.


• Conduct proactive cloud threat hunting and develop automated response playbooks/runbooks for common cloud security incidents.


• Review and help remediate high-risk cloud exposures, including public storage, exposed secrets, excessive permissions, and vulnerable internet-facing workloads.


• Partner with SOC, cloud/platform, application, and MDR/MSSP teams to improve cloud detection, response, and overall incident readiness.

Skills and Requirements

• 10+ years of cybersecurity experience, including 5+ years focused on Azure and/or AWS cloud security.


• Hands-on SOC, incident response, or detection and response experience investigating real cloud security incidents.


• Strong Azure knowledge, including Entra ID, RBAC, storage accounts, Key Vault, networking, managed identities, and Azure Activity and diagnostic logs.


• Strong AWS knowledge, including IAM, S3, EC2, VPC, CloudTrail, GuardDuty, and Security Hub.


• Hands-on experience with Microsoft Defender for Cloud, CrowdStrike SaaS Shield, and/or Wiz.


• Experience with CrowdStrike NG-SIEM or a comparable SIEM, including writing KQL queries.


• Strong understanding of cloud identity attacks, privilege escalation, persistence, and data exfiltration.


• Scripting experience with Python, PowerShell, Azure CLI, and/or AWS CLI.


• Ability to communicate technical incidents clearly and explain them in business-risk terms.Experience with Microsoft Fabric/OneLake, Azure Data Factory, Synapse, or similar cloud data platforms.Experience with Microsoft Defender XDR, Defender for Cloud Apps, or CrowdStrike Falcon Cloud Security.Kubernetes and container security experience, including AKS or EKS.Infrastructure-as-code experience with Terraform, Bicep, or CloudFormation.Certifications such as AZ-500, SC-200, AWS Certified Security – Specialty, GCLD, or GCIH. Hands‑on ability is valued more than certifications.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [e-mail].