Key skills
Azure securityEntra ID Conditional AccessEndpoint Detection and Response (EDR)SentinelOneMicrosoft DefenderSophosKQL (Kusto Query Language)Log AnalyticsSIEMIncident responseSecurity architecture reviewsSecurity policy managementSOC 2 Type II complianceDrataPulumi (Go) Infrastructure as CodePowerShell scriptingBash scriptingISO 27001GDPRPenetration testing coordinationAzure FirewallNetwork Security Groups (NSGs)Azure Key VaultRole-Based Access Control (RBAC)Privileged Identity Management (PIM)Independent workingGoBashPowerShellAnalyticsAzureTerraformPulumiVaultAzure MonitorEntra IDSSOCloud Security
About this role
Entegrata is a fast-growing startup transforming how the legal industry works with data. They are seeking a Senior Security Engineer to be the dedicated security owner for their Azure platform, responsible for running security reviews, managing compliance, and driving incident response.
Responsibilities:
- Review architecture and changes for security impact, keep our security baselines and policies current, and run posture management across the environment (Defender for Cloud), driving findings through to remediation
- Own detection engineering and IR day to day — KQL detections in Log Analytics, Azure Monitor dashboards, SIEM forwarding via Event Hub, and incident.io alerting and runbooks. The Security Lead steps in as incident commander for major events
- Own Entra ID Conditional Access (device-based policies, Enterprise SSO) and our EDR estate — SentinelOne (primary on macOS), Microsoft Defender (Windows), and the remaining Sophos footprint. Define the device-security baselines that compliant endpoints must meet
- Own our SOC 2 Type II program day to day in Drata — evidence collection, control monitoring, customer security questionnaires, and vendor / third-party risk — partnering with security, IT, and engineering
- Shape posture, guardrails, and Defender for Cloud coverage together with the Security Lead
- Define the security requirements and guardrails that get implemented in our Pulumi (Go) IaC, and review and contribute to that code
- Set the device-security baselines (compliance policies, LAPS, BitLocker/FileVault, ASR rules, removable-media controls) and partner on patch posture
Requirements:
- Cloud security depth (Azure). Hands-on securing Azure — identity (Entra ID, RBAC, managed identities, PIM), network, and secrets / key management (Key Vault, customer-managed keys)
- Identity & endpoint. Practical experience with Entra Conditional Access and at least one major EDR platform (SentinelOne, Microsoft Defender, or equivalent)
- Detection & IR. Detection-engineering and incident-response experience, including writing KQL against Log Analytics or a comparable SIEM, and running investigations end to end
- Security reviews & policy. Experience running security and architecture reviews and maintaining security policies and posture
- Compliance. SOC 2 Type II experience, ideally hands-on with Drata or a comparable platform — comfortable owning evidence, controls, and customer security questionnaires
- Ownership. A senior IC who can run the security function independently and partner across engineering, IT, and compliance
- Comfort reading and contributing to infrastructure as code (Pulumi and/or Terraform) and scripting in PowerShell and/or Bash for security automation — a plus, but you won't own infra builds
- Deeper DevSecOps / IaC build experience — Go and Pulumi development. This is the area a future dedicated hire will own; useful here, but not required
- Familiarity with ISO 27001 or GDPR, control frameworks
- Coordinating penetration tests and driving remediation to closure
- Experience with multi-tenant or per-client isolated (“stamp”) architectures