REMOTE - Sr. Security Engineer - Cloud Security & Detection

Fortellar•Chicago, IL

1d•$140,000 - $160,000•Remote

About The Position

The Sr. Security Engineer, Cloud Security & Detection designs, deploys, and operates cloud security posture, data protection, and detection and response capabilities for Fortellar clients. The role is primarily assigned to large-scale, multi-workstream security remediation engagements, often addressing substantial backlogs of cloud posture findings and transitioning security capabilities from incumbent vendors to the Microsoft platform already licensed by the client. The work involves Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Defender XDR, and Microsoft Purview. This is a hands-on engineering role with direct client exposure. The engineer establishes and validates replacement detection capabilities before an incumbent managed service is decommissioned, and works through incident backlogs where response processes may not previously have existed. The role requires deep Azure and Microsoft security platform expertise, incident response experience, strong written and verbal communication, and the ability to represent Fortellar credibly with client technical staff and executives, in person and virtually. Travel to client sites is required 10%–20%. The role is open only to candidates who currently live and are authorized to work in the United States. Applications must be submitted from within the U.S.; applications submitted from a location that does not match the candidate’s stated location will not be considered.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field.
At least 8 years of infrastructure or security engineering experience, including at least 5 years securing Azure environments.
At least 4 years building and tuning Microsoft Sentinel detections using KQL, including Defender XDR and Defender for Cloud.
Hands-on incident response experience, including leading responses to critical incidents.
Experience with policy-as-code (Azure Policy, Terraform, or Bicep), Microsoft Purview, and security automation (Logic Apps or Sentinel playbooks).
At least 3 years in a client-facing consulting role, presenting to technical and executive stakeholders.
Track record of leading high-risk changes through formal change management, using pilots, staged rollouts, and rollback plans.
Strong verbal and written communication skills and professional presence with client technical staff and executives.
Must currently live and be authorized to work in the United States; applications must be submitted from within the U.S.
Ability to travel 10%–20% to client sites.

Nice To Haves

Preferred certifications: AZ-500, SC-200, SC-100, CCSP, or CISSP.

Responsibilities

Assign an owner and closure date to every open cloud finding, review standing exemptions, and revoke exemptions lacking written rationale and an expiry date.
Eliminate anonymous and public access from internet-facing cloud resources, including enabling authentication on function applications and removing public storage access.
Rotate and remove verified secrets embedded in cloud resources and disable shared-key access across storage accounts, prioritizing those containing sensitive data.
Establish private link connectivity, network rules, and network security group coverage as platform standards, and adopt managed identities for web applications and functions.
Route diagnostic and platform logs into Microsoft Sentinel and manage ingestion scope and cost against the agreed platform budget.
Implement landing-zone guardrails as policy-as-code and review identified attack paths monthly.
Triage and close high-severity incident backlogs, recording disposition and evidence for each incident.
Author and publish the incident response plan, severity matrix, and escalation path; define incidents for ratified policy, including insurer and regulatory notification triggers.
Ensure each finding has an owner and disposition, and complete mail-flow, quarantine, and anti-impersonation configuration.
Facilitate cross-functional response during critical incidents with client technical staff, executives, and third-party providers.
Define and test monitoring coverage hours and out-of-hours escalation paths, establish a threat-hunting cadence, and facilitate tabletop exercises with client stakeholders.
Build and tune Microsoft Sentinel analytics rules, watchlists, and workbooks; manage data connectors and detection coverage against a defined threat model.
Produce the technical evaluation supporting the managed detection sourcing decision and transition detection to the selected platform, running the incumbent service in parallel until equivalence is demonstrated.
Design and deploy automated and agentic response playbooks for high-volume alert types, using scoped credentials, no standing privilege, and named human approval for production-impacting containment.
Reduce alert volume and mean time to resolution through tuning, automation, and suppression of validated false positives.
Evaluate emerging tooling and AI-driven detection and response capabilities for client and internal operations.
Design and operate pilot rings and staged rollouts for changes capable of disrupting access or production workloads.
Prepare, submit, and present change records through the client’s change process, including risk, blast radius, validation steps, and backout plans.
Execute changes during scheduled maintenance windows, including evenings and weekends when changes cannot safely be made during business hours.
Halt or defer rollouts when validation is incomplete and promptly communicate the decision and schedule impact to the engagement lead and client.