Senior Security Engineer

Entegrata is a fast-growing SaaS company that delivers Azure-based data lakehouse platforms for law firms, helping them turn operational, financial, and matter data into decision-grade insights. The Senior Security Engineer will own security and compliance for the Azure platform, including security reviews, posture management, detection and incident response, identity and endpoint security, and the SOC 2 / Drata program.

Responsibilities:

• Security reviews & posture. Review architecture and changes for security impact, keep our security baselines and policies current, and run posture management across the environment (Defender for Cloud), driving findings through to remediation
• Detection & incident response. Own detection engineering and IR day to day — KQL detections in Log Analytics, Azure Monitor dashboards, SIEM forwarding via Event Hub, and incident.io alerting and runbooks. The Security Lead steps in as incident commander for major events
• Identity & endpoint security. Own Entra ID Conditional Access (device-based policies, Enterprise SSO) and our EDR estate — SentinelOne (primary on macOS), Microsoft Defender (Windows), and the remaining Sophos footprint. Define the device-security baselines that compliant endpoints must meet
• Compliance (SOC 2 / Drata). Own our SOC 2 Type II program day to day in Drata — evidence collection, control monitoring, customer security questionnaires, and vendor / third-party risk — partnering with security, IT, and engineering. This is the security–to–compliance bridge, and may grow into a dedicated compliance role as we scale
• Cloud & Azure security. Shape posture, guardrails, and Defender for Cloud coverage together with the Security Lead
• Security as code. Define the security requirements and guardrails that get implemented in our Pulumi (Go) IaC, and review and contribute to that code. Building and operating the infrastructure is owned by the team today, with a future DevSecOps hire — you set and verify the security bar, you don’t own the build
• Device management. A separate IT hire owns Microsoft Intune and patching; you set the device-security baselines (compliance policies, LAPS, BitLocker/FileVault, ASR rules, removable-media controls) and partner on patch posture

Requirements:

• Hands-on securing Azure — identity (Entra ID, RBAC, managed identities, PIM), network, and secrets / key management (Key Vault, customer-managed keys)
• Practical experience with Entra Conditional Access and at least one major EDR platform (SentinelOne, Microsoft Defender, or equivalent)
• Detection-engineering and incident-response experience, including writing KQL against Log Analytics or a comparable SIEM, and running investigations end to end
• Experience running security and architecture reviews and maintaining security policies and posture
• SOC 2 Type II experience, ideally hands-on with Drata or a comparable platform — comfortable owning evidence, controls, and customer security questionnaires
• A senior IC who can run the security function independently and partner across engineering, IT, and compliance
• Familiarity with ISO 27001 or GDPR,control frameworks
• Coordinating penetration tests and driving remediation to closure
• Experience with multi-tenant or per-client isolated (“stamp”) architectures
• Comfort reading and contributing to infrastructure as code (Pulumi and/or Terraform) and scripting in PowerShell and/or Bash for security automation — a plus, but you won't own infra builds
• Deeper DevSecOps / IaC build experience — Go and Pulumi development. This is the area a future dedicated hire will own; useful here, but not required