Cloud Security Engineer (DED)

Experis; Colorado; Hybrid; USD 120,000 - 190,000; Full time

Job summary

Experis is seeking a Cloud Security Engineer with deep Azure, Sentinel, Defender for Cloud, and KQL expertise to design and implement enterprise-scale data exfiltration detection and cloud security controls. You will build exfiltration detectors in KQL, map risks to controls, and drive secure deployments across multiple tenants.

You will participate in CI/CD workflows, policy-based security, and integration with M365, Entra ID, and Defender XDR.

Qualifications

• 5+ years in cloud security engineering.
• 3+ years hands-on Azure experience.
• Ability to map exfiltration points to controls and document gaps.
• Proven experience building and testing Sentinel exfiltration detections in KQL.

Responsibilities

• Deploy Defender for Cloud protections across multiple Azure tenants using Policy-as-Code pipelines.
• Centralize logging in Microsoft Sentinel and integrate Azure, M365, and AWS.
• Develop and tune KQL-based exfiltration detections for data volumes, rate changes, and abnormal access.
• Detect exfiltration in Azure IaaS by enabling Defender for Servers, logging, and traffic analytics.

Skills

Azure

Sentinel

Defender for Cloud

KQL

data exfiltration detection

Cloud security engineering

Policy as Code

CI/CD

M365 audit logs

Entra ID

Defender XDR

Cloud Apps

Threat hunting

Detection engineering

SC-200

AZ-500

SC-100

AWS GuardDuty

Tools

Azure DevOps

GitHub

Job description

The ideal candidate is a Cloud Security Engineer with deep Azure, Sentinel, Defender for Cloud, and KQL expertise who has specifically built data exfiltration detection capabilities and implemented cloud security controls at an enterprise scale.

What you'll do

• Deploy Microsoft Defender for Cloud protections (Key Vault, Storage, Databases, AI, API) across several Azure tenants using Azure Policy and Policy-as-Code pipelines.
• Centralize logging in Microsoft Sentinel by turning on audit and resource logs and connecting Azure, M365 and AWS.
• Build and tune exfiltration detections in KQL that flag unusual data volumes, rate changes and abnormal access patterns across M365, PaaS and SaaS services.
• Detect exfiltration from Azure IaaS workloads by:
  • enabling Defender for Servers and VNet/NSG flow logs with Traffic Analytics;
  • using Firewall logs to baseline normal outbound traffic;
  • alerting on large or unusual transfers to the internet or unknown destinations.
• Map exfiltration paths to controls and document coverage gaps and recommendations.
• Create triage playbooks and runbooks with clear escalation paths, then hand them over to the InfoSec/SOE team.

Required Skills

• 5+ years in cloud security engineering, including at least 3 years of hands-on Azure work.
• Being able to map exfiltration points to controls and document coverage gaps, such as exfiltration through legitimate native features.
• To be able to build and test custom Sentinel exfiltration detections in KQL. These should cover unusual volumes, rate changes and abnormal patterns, including Exchange and Microsoft Graph API activity spikes.
• Has deployed Microsoft Defender for Cloud plans at enterprise scale in more than one tenant.
• Strong Microsoft Sentinel skills: data connectors, analytics rules, KQL, workbooks and automation rules.
• Azure Policy / Policy-as-Code and deployment through CI/CD (Azure DevOps or GitHub).
• Good understanding of M365 audit logs, Entra ID and Defender XDR / Cloud Apps.
• Works within a formal change process (ServiceNow CRQ) and can document clearly.

• AWS GuardDuty, CloudTrail and Organizations-level security setup.
• Microsoft Purview: DLP, Insider Risk Management and audit.
• Background in detection engineering or threat hunting focused on data exfiltration.
• Experience after an incident or in a remediation program.
• Certifications such as SC-200, AZ-500 or SC-100.
  • AWS Security Specialty is a plus.