Cloud Security Engineer

Sand Tech Holdings Limited

About The Position

Sand Technologies is building its security engineering capability, and this engineer will be its first security engineer, working directly with the Director of Cyber Security. The role focuses on implementing and managing cloud security across AWS, Azure, and GCP. It is a hands-on position with a substantial role in audits, executive metrics, and the security posture of a live AI product. The engineer will work with three cloud platforms, Microsoft security tools, evidence for four frameworks, and security controls for a shipping AI product, with mentorship from the security director and visibility into executive reporting. The position combines incident response, security-tool operation and tuning, vulnerability-data management, detection engineering, remediation coordination, CI/CD security, telemetry, and audit readiness. During the first 90 days, the engineer is expected to take ownership of the vulnerability data pipeline, complete a tooling parity validation, deliver and verify a structural remediation, establish telemetry in a new cloud environment, and lead an incident or tabletop exercise with documented lessons learned. The role works collaboratively with infrastructure and DevOps teams and with colleagues in small, internationally distributed teams. Clear, consistent communication through virtual collaboration tools and video conferencing is essential.

Requirements

At least 5–7 years of professional cloud or DevOps experience.
At least 2–4 years in security engineering, cloud/DevOps with a security focus, or security operations.
Working proficiency in at least one major cloud platform: AWS, Azure, or GCP; willingness to learn the other two.
Scripting skills for automation; Python is preferred.
Comfort using REST APIs and structured data such as JSON and CSV.
Understanding of vulnerability-management fundamentals, including CVE/CVSS, scanning versus remediation, and SLA-driven programs.
A calm, methodical approach to incident response.
Clear writing and the ability to explain findings to engineers and risks to executives.
Self-direction and ability to work with guidance rather than a prescriptive script.
Comfort working in small teams and contributing to larger, globally coordinated efforts.
Ownership, self-motivation, discipline, and clear, consistent communication through virtual collaboration tools and video conferencing.

Nice To Haves

KQL or SQL skills.
Hands-on experience with Microsoft Defender, Microsoft Sentinel, or Qualys.
Terraform or other infrastructure-as-code experience.
Container security experience, including ECR or AKS image scanning and lifecycle policies.
Experience producing evidence for Cyber Essentials, ISO 27001, SOC 2, or ISO/IEC 42001.
Relevant certifications such as SC-200, AZ-500, or Security+, or equivalent demonstrated skill.

Responsibilities

Serve as a second responder on security incidents involving fraud, phishing, endpoints, identity, shadow IT, and cloud; collect evidence, triage, coordinate containment, and document lessons learned.
Operate and tune Microsoft Defender for Cloud and Endpoint, Intune, Sentinel, and vulnerability-scanning tools across a multi-account AWS organization, GCP, and Azure.
Build and maintain the vulnerability data pipeline, including cloud-tool exports, deduplication by unique CVE, finding-age and SLA calculations, and feeds for security metrics.
Run side-by-side tooling parity validations during platform transitions and produce audit-ready evidence.
Partner with infrastructure and DevOps teams on remediation, including container base-image hygiene, registry lifecycle policies, and exposure management; verify closure with follow-up scans.
Track remediation SLAs, support exception and risk-acceptance workflows, and maintain runbooks and process documentation.
Build detections in Microsoft Sentinel by onboarding and tuning email, identity, endpoint, SaaS, and cloud log sources.
Embed security gates in CI/CD pipelines and establish telemetry for new environments.
Contribute evidence to Cyber Essentials, ISO 27001, SOC 2, and ISO/IEC 42001 readiness workstreams.
Within the first 90 days, own the weekly vulnerability data pipeline end to end; complete a documented tooling parity validation; deliver and scan-verify a structural remediation; establish telemetry in one new cloud environment; and lead an incident or tabletop exercise with lessons incorporated into runbooks.