Security Engineer

Join our team as a Security Engineer III, where you will be responsible for detecting and responding to threats across our cloud estate. You will design and build our security data lake, write and version-control detections, and automate triage and enrichment. You will also harden our Azure and AWS environments, deliver cloud security controls as Terraform, and run detection coverage assessments. This is a hands-on building role that requires strong cloud security fundamentals and production experience in both Azure and AWS.

• Concevoir et construire un lac de données de sécurité, décider des télémetries à ingérer et comment elles sont normalisées.
• Écrire, ajuster et contrôler les détections en tant que code, posséder le cycle de vie complet : hypothèse, requête, test, déploiement.
• Renforcer nos environnements Azure et AWS, gérer les contrôles de sécurité cloud en tant que Terraform.

• Scripting and automation ability in Python or a comparable language, enough to build and maintain tooling rather than only configure vendor products
• Strong cloud security fundamentals: RBAC and least privilege, secret and key management, egress control, and public-exposure prevention
• Production Terraform experience. You've written and maintained modules other teams consume, and you know why a security control belongs in code rather than in a runbook
• Real operational depth in both Azure and AWS: identity models, logging and audit sources, network boundaries, and where each provider's defaults leave you exposed
• Demonstrated detection building. You've written detections against real telemetry, tuned them against real false positives, and can explain a specific rule you shipped and how you validated it
• 5+ years in security engineering, cloud operations, or detection engineering, with recent hands-on ownership of production cloud security work
• Fluency in at least one query language for security data (KQL, SQL, or equivalent) and the judgment to know when a query problem is actually a data-model problem
• A track record of shipping production code or infrastructure you can point to. This is a hands-on building role, not an advisory one
• Microsoft Sentinel at production scale: analytics rules, automation rules, ingestion cost management, and multi-workspace design
• Wiz experience, including turning posture and attack-path findings into an owned remediation workflow
• Incident response experience in a cloud environment, on-call or as an investigator
• Kubernetes and container security exposure (AKS, EKS) and runtime detection for containerized workloads
• Security data lake or SIEM migration experience, including cost and retention tradeoffs
• Familiarity with regulated-industry audit expectations (SOC 2 Type 2, ISO 27001, FedRAMP, HITRUST) and what auditors want from logging and monitoring controls
• Relevant certifications (Azure or AWS security specialty, GCIA, GCDA, or similar)