Cloud Security Engineer (DED)

Experis to światowy lider rekrutacji specjalistów i kadry zarządzającej w kluczowych obszarach IT.

• 5+ years in cloud security engineering, including at least 3 years of hands-on Azure experience.
• Ability to map exfiltration points to controls and document coverage gaps.
• Build and test custom Sentinel exfiltration detections in KQL, covering unusual volumes, rate changes, and abnormal patterns including Exchange and Microsoft Graph API spikes.
• Experience deploying Microsoft Defender for Cloud plans at enterprise scale across multiple tenants.
• Strong Microsoft Sentinel skills: data connectors, analytics rules, KQL, workbooks, and automation rules.
• Expertise in Azure Policy / Policy-as-Code and CI/CD deployment using Azure DevOps or GitHub.
• Good understanding of M365 audit logs, Entra ID, Defender XDR, and Cloud Apps.
• Experience working within formal change processes (ServiceNow CRQ) and documenting clearly.
• Knowledge of AWS GuardDuty, CloudTrail, and Organizations-level security setup.
• Familiarity with Microsoft Purview features such as DLP, Insider Risk Management, and audit.
• Background in detection engineering or threat hunting focused on data exfiltration.
• Experience in incident response or remediation programs.
• Certifications such as SC-200, AZ-500, or SC-100; AWS Security Specialty is a plus.

• Deploy Microsoft Defender for Cloud protections (Key Vault, Storage, Databases, AI, API) across Azure tenants using Azure Policy and Policy-as-Code pipelines.
• Centralize logging in Microsoft Sentinel by enabling audit and resource logs and connecting Azure, M365, and AWS.
• Build and tune exfiltration detections in KQL that flag unusual data volumes, rate changes, and abnormal access patterns across M365, PaaS, and SaaS services.
• Detect exfiltration from Azure IaaS workloads by enabling Defender for Servers and VNet/NSG flow logs with Traffic Analytics, using Firewall logs to baseline normal outbound traffic, and alerting on large or unusual transfers.
• Map exfiltration paths to controls and document coverage gaps and recommendations.
• Create triage playbooks and runbooks with clear escalation paths and hand them over to the InfoSec/SOE team.