Job Specification: Azure Cloud Security Engineer - Microsoft Defender for Cloud

Role Overview

The Azure Cloud Security Engineer will work within the Cyber Pillar, supporting the Enhance Azure Security stream, with a dotted-line reporting relationship to the Cyber Cloud & Application Engineering team.

The role is responsible for assessing, improving and operationalising Azure cloud security capabilities, with a particular focus on Microsoft Defender for Cloud, Cloud Security Posture Management (CSPM), workload protection, vulnerability management and Azure platform security governance.

Working closely with the Project Manager, Cybersecurity, Cloud & Application Engineering, Identity and Access Management (IAM), Threat Detection & Response (TDR), and Threat & Vulnerability Management teams, the role will drive the remediation of security gaps, improve cloud security posture in line with industry best practices, and establish sustainable processes for ongoing security management.

The successful candidate will combine strong hands-on technical expertise in Microsoft Azure security with effective stakeholder management, documentation and knowledge transfer skills to ensure that security capabilities are embedded into BAU operations.

Key Responsibilities

1. Azure Security Assessment and Enhancement

• Work within the Cyber Pillar on the Enhance Azure Security stream, maintaining a dotted-line relationship with the Cyber Cloud & Application Engineering team.
• Collaborate with the Project Manager to support effective project planning, delivery, prioritisation and tracking of activities designed to improve Azure security and overall cloud security posture.
• Assess the current Microsoft Defender for Cloud configuration and recommend improvements in line with industry standards, security best practices and organisational requirements.
• Analyse, assess and prioritise Microsoft Defender for Cloud CSPM recommendations based on risk, business impact, exposure and remediation complexity.
• Identify and assess Azure attack surfaces, security misconfigurations and areas of risk, working with relevant teams to agree and implement appropriate remediation actions.
• Support the implementation of Microsoft Cloud Security Benchmark recommendations, working with the Cloud team to define, agree and deliver the required security actions.
• Ensure Azure platform security designs and implementation approaches align with ESB best practices and established architectural standards.

2. Security Remediation and Governance

• Work collaboratively with Cybersecurity, Cloud and IT teams to remediate CSPM recommendations, security misconfigurations and identified attack surface risks.
• Provide technical guidance to IT and Cloud teams to support the effective and timely resolution of security findings.
• Follow established Change Management processes to ensure remediation activities are appropriately assessed, approved, tested and implemented without adversely impacting live services.
• Assess Azure Role-Based Access Control (RBAC) configurations and Privileged Identity Management (PIM) usage, working with the IAM team to implement recommended improvements.
• Support the definition and implementation of appropriate security governance, controls and exception management processes for the Azure platform.
• Track remediation progress, highlight outstanding risks and dependencies, and support the escalation of issues where required.

3. Threat Detection, Vulnerability Management and Response

• Work with the Threat Detection & Response (TDR) team to ensure appropriate security alerting, monitoring and incident response plans are established for Azure environments.
• Collaborate with the Threat & Vulnerability Management team to design and implement effective cloud vulnerability management processes.
• Support the integration of Azure security capabilities into existing threat detection, vulnerability management and incident response processes.
• Ensure relevant Defender for Cloud security findings, alerts and recommendations are appropriately managed, assigned and tracked through to resolution.
• Help establish repeatable processes for ongoing cloud security posture monitoring, vulnerability remediation and threat detection.

4. Operationalisation of Defender for Cloud

• Work with Cybersecurity and Cloud teams to operationalise Microsoft Defender for Cloud, ensuring that the solution is effectively integrated into existing security and operational processes.
• Define and document roles and responsibilities for the ongoing management, monitoring, maintenance and remediation of Defender for Cloud findings.
• Develop and implement operational processes covering cloud security governance, threat and vulnerability management, security exceptions, ongoing posture management, and threat detection and response.
• Facilitate the transition of security capabilities and processes into the appropriate operational teams, ensuring clear ownership and accountability.
• Identify and deliver any required training, knowledge transfer and supporting materials to enable sustainable BAU ownership.
• Support the development of repeatable, scalable processes that enable continuous improvement of Azure platform security.

5. Documentation and Knowledge Transfer

• Develop and maintain comprehensive documentation covering Defender for Cloud configuration, security controls, operational procedures and remediation processes.
• Document Azure platform security processes, including governance, vulnerability management, exception handling, posture management and threat detection and response.
• Produce clear technical guidance, operating procedures and supporting materials for Cybersecurity, Cloud and IT teams.
• Deliver knowledge transfer to the Cyber Cloud & Application Engineering team and other relevant stakeholders to support ongoing ownership and operational effectiveness.
• Ensure documentation reflects the implemented configuration, agreed responsibilities, established processes and relevant security standards.

6. Stakeholder Engagement and Collaboration

• Build effective working relationships across Cybersecurity, Cloud & Application Engineering, IAM, TDR, Threat & Vulnerability Management, IT Operations and project delivery teams.
• Communicate technical security risks, recommendations, remediation requirements and progress clearly to both technical and non-technical stakeholders.
• Work collaboratively to resolve dependencies, agree remediation approaches and ensure security improvements are delivered within the agreed project scope and timelines.
• Provide regular updates on delivery progress, key risks, issues and outstanding actions to the Project Manager and relevant stakeholders.

Knowledge, Skills and Experience

Essential

• Demonstrable experience deploying, configuring and managing Microsoft Defender for Cloud within Microsoft Azure environments, including CSPM and cloud workload protection capabilities.
• Proven experience assessing cloud security posture and remediating security recommendations, including providing technical guidance to IT and Cloud teams to resolve configuration issues.
• Practical experience implementing the Microsoft Cloud Security Benchmark and translating security recommendations into actionable remediation plans.
• Experience assessing Azure security configurations, identifying misconfigurations and prioritising remediation based on risk and business impact.
• Experience operationalising cloud security capabilities and developing documented processes to support ongoing management and BAU operations.
• Understanding of Azure identity and access management, including Role-Based Access Control (RBAC), privileged access and Microsoft Entra ID Privileged Identity Management (PIM).
• Experience working with cross-functional teams to implement security controls and remediation activities within established Change Management processes.
• Strong understanding of cloud security governance, vulnerability management, security posture management and threat detection and response principles.
• Excellent interpersonal, communication and presentation skills, with the ability to engage effectively with technical teams, project stakeholders and senior audiences.
• Excellent written communication and documentation skills, including the ability to produce clear technical documentation, operational procedures and knowledge transfer materials.
• Strong analytical, problem-solving and organisational skills, with the ability to prioritise competing activities and drive security improvements through to completion.

Desirable

• Hands-on experience managing, configuring and administering Microsoft Azure resources.
• Experience integrating Microsoft Defender for Cloud with Microsoft Sentinel to support security monitoring, alerting and incident response.
• Familiarity with cloud operations processes, including service management, operational handover, incident management and change control.
• Experience working with Cloud & Application Engineering teams to align security controls with established architectural and engineering best practices.
• Experience defining and implementing cloud security operating models, including ownership, responsibilities, governance and ongoing service management.
• Relevant Microsoft Azure or cybersecurity certifications.

Key Deliverables and Expected Outcomes

The successful candidate will be expected to contribute to the following outcomes:

• An assessed and improved Microsoft Defender for Cloud configuration aligned with agreed security standards and organisational requirements.
• A prioritised and actively managed backlog of CSPM recommendations, with clear remediation ownership and progress tracking.
• Implementation of agreed Microsoft Cloud Security Benchmark recommendations and associated security improvements.
• Improved Azure RBAC and PIM configurations in collaboration with the IAM team.
• Defined cloud vulnerability management, security exception, posture management and threat detection and response processes.
• Appropriate Azure security alerting and response arrangements agreed with the TDR team.
• Documented Defender for Cloud configurations, security procedures, governance arrangements and operational responsibilities.
• Successful transition of relevant capabilities and processes to BAU teams, supported by effective knowledge transfer and training.
• Alignment of Azure platform security improvements with ESB best practices and established Change Management requirements.

Measures of Success

Success in the role will be demonstrated through:

• Measurable improvement in Azure security posture against agreed benchmarks and security objectives.
• Reduction in the number and severity of outstanding high-priority cloud security recommendations.
• Timely remediation of agreed security findings, with clear ownership and appropriate risk acceptance where remediation is not immediately possible.
• Effective implementation of agreed security controls without material disruption to live services.
• Clear ownership of operational processes across Cybersecurity, Cloud & Application Engineering and relevant supporting teams.
• Successful handover of security capabilities into BAU, supported by complete documentation and demonstrable knowledge transfer.