Azure Security Engineer

MatchPoint is seeking an Azure Security Engineer to enhance their cloud security posture. The role involves designing and implementing security controls on Azure, configuring security services, and conducting assessments to ensure compliance with security benchmarks.

Responsibilities:

• Support the design and implementation of Azure landing zone controls, identity, and network guardrails (VNet, NSGs, private endpoints) as directed by Ardent Mills security leadership
• Configure and tune cloud-native security services (Microsoft Sentinel, Defender XDR)
• Configure and tune Microsoft Defender for Cloud Apps (CASB) — connected apps, policies, session controls, and real-time monitoring integrations (e.g., Power Platform / citizen developer governance)
• Perform Cloud Security Posture Management (CSPM) assessments against CIS Azure Foundations Benchmark and Microsoft Cloud Security Benchmark (MCSB), and deliver prioritized remediation plans
• Execute tooling onboarding and configuration for in-scope cloud security tools as directed, including baseline setup, policy configuration, and integration
• Build and deploy Azure Policy initiatives, policy-as-code, and automated remediation to reduce configuration drift
• Implement key management, encryption at rest/in transit, and certificate governance using Azure Key Vault
• Configure logging, telemetry, and alerting (Azure Monitor, Log Analytics) integrated with SIEM/XDR; validate detection coverage
• Harden serverless, containers, and managed services (Functions, Logic Apps, Container Apps, AKS, ACI) using established baselines
• Perform threat modeling and security reviews for specific in-scope cloud architectures and application designs
• Deliver IaC guardrails (Terraform/Bicep/ARM), image baselines, and vulnerability workflows in partnership with platform teams
• Support cloud incident triage and containment activities as needed during the engagement (not on-call escalation owner)
• Document standards, runbooks, and configurations to enable knowledge transfer to full-time staff at engagement close
• CSPM assessment report against CIS Azure Foundations / MCSB with prioritized, risk-ranked remediation plan
• Defender for Cloud Apps (CASB) configuration baseline — connected apps, policy set, session controls, and monitoring integrations documented
• Azure Policy Initiative library aligned to Ardent Mills governance requirements
• Resource standards baseline (tagging, naming, region restrictions, diagnostic settings)
• Key Vault governance standard and implementation
• Defender for Cloud posture improvement plan with measurable secure score uplift
• Tooling onboarding and configuration runbooks for in-scope cloud security tools
• Secure reference architecture(s) for in-scope workloads
• Detection coverage matrix mapped to MITRE ATT&CK for cloud
• Infrastructure drift monitoring framework and remediation playbooks
• Documentation package for knowledge transfer at end of engagement

Requirements:

• 4–7 years of hands-on cloud security engineering experience, primarily Microsoft Azure
• Demonstrated experience delivering Azure Policy, IaC guardrails, and CSPM/CWPP outcomes on prior engagements
• Hands-on experience configuring Microsoft Defender for Cloud Apps (CASB) or an equivalent CASB solution
• Experience performing posture assessments against CIS Benchmarks and/or Microsoft Cloud Security Benchmark
• Strong knowledge of IAM, networking, encryption, and cloud-native security tooling
• Experience securing hybrid environments spanning on-premises and Azure
• Scripting/automation expertise (KQL, Python/Bash/PowerShell; Terraform/Bicep/ARM)
• Certifications: Azure Security Engineer Associate (AZ-500) required
• CCSP or equivalent preferred