{"id":81299,"url":"https://alion.io/job/devoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus","title":"Devoteam Cyber Trust | Lead Cloud Security Consultant — Microsoft Focus","company":{"id":6640,"name":"Devoteam","domain":"devoteam.com","url":"https://alion.io/company/devoteam","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"A","score":90,"open_postings":571,"ghost_share":0,"stale_share":0.385,"repost_share":0,"time_to_fill_p50_days":50,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Lisbon, Portugal"],"countries":["PT"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":79000,"max_usd":203000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":623},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PCI DSS","optional":false},{"name":"Bicep","optional":true},{"name":"CI/CD","optional":true},{"name":"CIS Benchmarks","optional":true},{"name":"DLP","optional":true},{"name":"MITRE ATT&CK","optional":true},{"name":"Terraform","optional":true},{"name":"Wiz","optional":true}],"status":"live","first_seen_at":"2026-06-02T16:31:45Z","employer_posted_date":"2026-06-02","last_verified_at":"2026-10-18T09:41:58Z","board_verified":true,"closed_at":null,"days_open":137,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":137},"description":"Devoteam Cyber Trust is the Cybersecurity specialist arm of the Devoteam Group. With our 800+ experts located across EMEA, we aim to establish cybersecurity as an enabler of business success rather than a gatekeeper. We leverage an end-to-end approach to Cyber Resilience, Applied Security, and Managed Security services to secure the tech journey of large and medium-sized companies from all sectors and industries.\nSince 2009, previously known as INTEGRITY, our team based in Portugal is specialised in providing cutting-edge Managed Security Services that combine its expertise and proprietary technology to consistently and effectively reduce the cyber risk of our clients.\nThe comprehensive service range includes Persistent Intrusion Testing, ISO 27001, PCI-DSS, GRC Consulting and Solutions, and Third-Party Risk Management. ISO 27001 (Information Security) and ISO 9001 (Quality) certified, PCI-QSA, and member of CREST and CIS - Centre for Internet Security, we provide services to a considerable number of clients, operating in more than 20 countries.\n We're building a new Cloud Security Practice that delivers outcome-driven security engagements across Microsoft Azure, Microsoft 365, Google Cloud, AWS, and partner CNAPP platforms.\nWe're hiring a Lead Cloud Security Consultant - Microsoft Focus as a hands-on cyber security expert. You'll help design how we deliver engagements, execute them in the consoles, and build the reusable assets the practice will scale on.\nThis is a cyber-first role with Microsoft as the primary stack. Microsoft Sentinel, Defender XDR, Defender for Cloud, and Entra ID are the core of the work, but you should be comfortable operating in broader cloud security contexts - multi-cloud posture, CNAPP findings, exposure reduction - when engagements call for it. You don't need to be a pure infrastructure engineer, but you should understand cloud environments well enough to identify security gaps, implement controls, and help customers improve their posture.\nWhat you'll do\nDeliver cloud security engagements end-to-end with a Microsoft focus: Sentinel deployments, Defender XDR rollouts, Defender for Cloud implementations, detection engineering, threat hunting, incident response support, posture assessments, Azure security reviews, identity security improvements, cloud hardening.\n\nWrite KQL, tune analytics rules, build connectors, configure Defender XDR policies, and walk customers through what their telemetry, posture, exposure, and risks mean.\n\nAssess and improve security controls across Sentinel, Defender XDR, Defender for Cloud, Entra ID, Azure workloads, logging/monitoring, and privileged access.\n\nTranslate cyber security requirements into practical configurations, remediation actions, detection use cases, and operational improvements.\n\nSupport multi-cloud engagements (Google Cloud, AWS) and CNAPP-related work where the customer needs posture improvement, exposure reduction, or detection coverage.\n\nRun customer-facing workshops and build the reusable assets the practice will scale on: playbooks, deliverable templates, KQL libraries, detection rule packs, configuration baselines, hardening guides, remediation roadmaps.\n\n Microsoft Sentinel:\nDeployed or supported Sentinel in production for at least one enterprise customer.\n\nWrites KQL from scratch for analytics rules, hunting queries, investigations, and workbooks.\n\nHas built, tuned, or maintained analytics rules, scheduled queries, hunting queries, or incident workflows.\n\nHas worked with data connectors, including Microsoft and non-Microsoft sources.\n\nHas experience with automation rules, Logic Apps playbooks, or response workflows.\n\nUnderstands alert fatigue and has experience improving signal-to-noise in a SOC or monitoring environment.\n\nDefender XDR cross-pillar:\nConfigured and operated Defender for Endpoint, Identity, Office 365, and Cloud Apps.\n\nInvestigated incidents spanning multiple pillars using the unified incident model.\n\nComfortable with advanced hunting across the Defender XDR schema.\n\nUnderstands how Defender XDR and Sentinel complement each other in detection and response.\n\nAzure and cloud security:\nSolid Azure security understanding from a cyber perspective, not just infrastructure.\n\nHas delivered Azure security assessments, posture improvement, hardening, or secure configuration reviews.\n\nHands-on with Microsoft Defender for Cloud - recommendations, regulatory compliance, workload protection, posture management.\n\nUnderstands subscriptions/management groups, Azure Policy, RBAC, logging/monitoring, network exposure, and workload protection.\n\nComfortable working in broader cloud security contexts: posture management, workload protection, misconfiguration review, exposure reduction.\n\nIdentity and access:\nStrong Microsoft Entra ID security - MFA, Conditional Access, Identity Protection, access reviews, enterprise applications, service principals.\n\nFamiliarity with PIM, RBAC, least privilege, break-glass accounts, access governance.\n\nUnderstands identity as a core cloud security control.\n\nCloud security and CNAPP awareness:\nUnderstands CSPM, CWPP, attack paths, misconfiguration abuse, and cloud-specific attack patterns.\n\nFamiliar with CNAPP concepts and tools.\n\nCan turn cloud security findings into practical remediation plans for security, cloud, and engineering teams.\n\nDelivery experience:\n5+ years cybersecurity experience, including relevant experience with the Microsoft security stack in a delivery, consulting, cloud security, detection engineering, or senior SOC role.\n\nExperience delivering client-facing cyber security work, including assessments, implementations, workshops, remediation planning, or technical documentation.\n\nAble to produce clear technical deliverables: assessment reports, implementation plans, remediation roadmaps, configuration baselines, runbooks, and executive-level summaries.\n\nPortuguese and English.\n\nNice to have\nMicrosoft Purview - DLP, information protection, insider risk.\n\nGoogle Cloud or AWS security background.\n\nExposure to Wiz or another CNAPP platform.\n\nExperience with Infrastructure-as-Code security, ideally Terraform, Bicep, ARM templates, or CI/CD security reviews.\n\nExperience with DevSecOps, secure cloud deployment patterns, or security guardrails.\n\nKnowledge of Microsoft Cloud Security Benchmark, CIS Benchmarks, NIST, ISO 27001, MITRE ATT&CK, or cloud security reference architectures.\n\nExperience building reusable consulting assets, such as KQL packs, Sentinel deployment kits, Defender configuration guides, cloud security baselines, assessment methodologies, or remediation playbooks.\n\nCertifications\nStrongly valued: SC-100.\nAlso valued: SC-200, AZ-500, SC-300, SC-400, CISSP, CCSP, Google Cloud Professional Cloud Security Engineer, AWS Security Specialty.\nReal operational and delivery experience matters more than certification recall.\nWorking style\nHands-on by default, in consoles weekly.\n\nCyber-first mindset - you look at Azure, Microsoft 365, identity, endpoints, SaaS, and cloud workloads through risk, threat, control effectiveness, and operational security.\n\nMicrosoft-focused, cloud-aware - Microsoft is your strongest stack, but you can operate in multi-cloud conversations and broader cloud security engagements.\n\nDelivery-focused - you can assess, implement, document, and hand over.\n\nIterative - you'd rather ship a working v1 in two weeks than a perfect v1 in four months.\n\nPlain-language translator - you explain a detection, a risky identity configuration, a Defender recommendation, or a CNAPP finding to a SOC analyst and a CFO using different words and the same accuracy.\n\nBuilder - you leave behind reusable assets, not just closed tickets.\n\nPragmatic - you know the difference between an ideal target state and a workable next step for a real customer environment.\n\n Devoteam Group works for equal opportunities, promoting its employees based on merit and actively fights against all forms of discrimination. We are convinced that diversity contributes to the creativity, dynamism and excellence of our organization. All of our vacancies are open to people with disabilities.","description_format":"text","description_chars":8134,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Portugal","iso":"PT","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","Information Security","IT Consulting & Digital Transformation","Enterprise Apps Implementation Partners"],"lifecycle":[{"event":"open","at":"2026-06-02T16:31:45Z"}],"visa":[],"liveness":{"score":15,"band":"cold","label":"Long shot","p_open":1,"p_active":0.544,"p_room":0.28,"age_days":136,"expected_fill_days":50,"reasons":["conf:0","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/devoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus","json_url":"https://alion.io/job/devoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus.json","meta":{"generated_at":"2026-10-18T10:00:37Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14838,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6640},"rest":"https://alion.io/mcp/rest/get_company?id=6640"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdevoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdevoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdevoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/devoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdevoteam-devoteam-cyber-trust-lead-cloud-security-consultant-microsoft-focus"}]}