Cloud Security Engineer

Sand Technologies is hiring its first Cloud Security Engineer to build its security engineering capability. The role focuses on cloud security across AWS, Azure, and GCP, operating security tools, managing vulnerabilities and incidents, supporting audits, and improving security for a live AI product.

Responsibilities:

• Serve as second responder on security incidents across Sand: fraud, phishing, endpoint, identity, shadow IT, and cloud, running evidence collection, triage, containment coordination, and lessons learned
• Operate and tune our security stack: Microsoft Defender for Cloud/Endpoint, Intune, Sentinel, and vulnerability scanning across a multi-account AWS organization, GCP, and Azure
• Build and maintain the vulnerability data pipeline: raw exports from cloud-native tools, deduplication by unique CVE, finding-age and SLA computation, and the feeds behind our security metrics
• Run tooling validations — side-by-side parity testing when we transition platforms, with evidence that stands up to audit
• Partner with infrastructure/DevOps teams on remediation: container base-image hygiene, registry lifecycle policies, exposure management, and verifying closure on the next scan
• Track remediation SLAs, support exception and risk-acceptance workflows, and keep runbooks and process documentation current
• Build detection in Microsoft Sentinel: onboarding and tuning log sources across email, identity, endpoint, SaaS, and cloud
• Embed security gates in CI/CD pipelines and stand up telemetry for new environments
• Contribute evidence to Cyber Essentials, ISO 27001, SOC 2, and ISO/IEC 42001 readiness workstreams
• Own the weekly vulnerability data pipeline end-to-end (exports → dedup → SLA math → metrics feed)
• Complete one tooling parity validation with documented, audit-ready evidence
• Ship one structural remediation with the infrastructure team (e.g., registry lifecycle policies) and verify closure by scan
• Stand up telemetry on one new cloud environment from zero
• Step into the second-responder seat: run one incident or tabletop end to end, with documented lessons fed back into the runbooks

Requirements:

• grounded by at least 5-7 years of professional cloud/DevOps experience and at least  2–4 years in security engineering, cloud/DevOps with a security focus, or security operations
• Working proficiency in at least one major cloud (AWS, Azure, or GCP) and hunger to learn the other two
• Scripting for automation — Python preferred; comfort with REST APIs and structured data (JSON/CSV); KQL or SQL a plus
• Understanding of vulnerability management fundamentals (CVE/CVSS, scanning vs. remediation, SLA-driven programs) and a calm, methodical approach to incident response
• Clear writing and the ability to explain a finding to an engineer and its risk to an executive
• Self-direction
• must be comfortable operating in small teams while contributing to larger, globally coordinated efforts
• A strong sense of ownership, self-motivation and discipline in maintaining clear and consistent communication through virtual collaboration tools and video conferencing is essential
• Python
• KQL or SQL
• Hands-on time with Microsoft Defender / Sentinel, or Qualys
• Terraform or other infrastructure-as-code exposure
• Container security (ECR/AKS image scanning, lifecycle policies)
• Cyber Essentials, ISO 27001, SOC 2, or ISO/IEC 42001 evidence experience
• Relevant certifications: SC-200, AZ-500, Security+ (or equivalent demonstrated skill)