REMOTE - Sr. Security Engineer - Cloud Security & Detection

About Fortellar

We are a boutique IT consulting and business process outsourcing organization supporting mid to enterprise-level organizations. We are a small, but mighty, team of experts who know how to stretch, adapt, and put on any hat required in the moment to make our clients successful and enable Fortellar’s growth. Keys to success at Fortellar include:

• Collaboration: You demonstrate excellence in remote collaboration across your Fortellar and client teams.

• Growth Mindset: You embrace personal growth and are always learning new things to support your team, your clients, and your personal goals.

• Client Success: You have a passion for your client’s success – you don’t just deliver to the contract you ensure that your client’s goals and needs are met.

• Humanity First: Honest and transparency are your natural instincts – your actions speak louder than your words and your team members love working with you.

• Entrepreneurial: You find a way to get it done, no matter what the challenges or seeming blockers are in front of you

The Sr. Security Engineer, Cloud Security & Detection designs, deploys, and operates cloud security posture, data protection, and detection and response capability for Fortellar's clients, with primary assignment to large-scale, multi-workstream security remediation engagements. The role is typically responsible for closing the largest single pool of open findings in the client estate, and for transitioning detection and data security capability off incumbent external vendors and onto the Microsoft platform the client already licenses. Engagements involve cloud estates carrying substantial backlogs of open posture findings, together with Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Defender XDR, and Microsoft Purview.

This is a hands-on engineering role with direct client exposure. The engineer is accountable for standing up a detection capability that must be proven equivalent to an incumbent managed service before that service is decommissioned, and for clearing an incident backlog in an environment where no response process previously operated. The role requires deep Azure and Microsoft security platform expertise, real incident response experience, strong verbal and written communication, and the professional presence to represent Fortellar credibly in front of client technical staff and executives, both in person and virtually.

Must be able to travel 10% - 20% to client sites

• Assign a named owner and a closure date to every open cloud finding, and review all standing exemptions, revoking those without a written rationale and an expiry date.
• Eliminate anonymous and public access from internet-facing cloud resources, including enabling authentication on function applications and removing public access from storage accounts.
• Rotate and remove verified secrets embedded in cloud resources, and disable shared-key access across storage accounts, prioritizing those holding sensitive data.
• Establish private link connectivity, network rules, and network security group coverage as platform standards, and adopt managed identity for web applications and functions.
• Route diagnostic and platform logging into Microsoft Sentinel, and manage ingestion scope and cost against the agreed platform budget.
• Implement landing-zone guardrails as policy-as-code so that remediated configuration cannot regress, and review identified attack paths on a monthly cadence.

• Triage and close the standing backlog of high-severity security incidents, establishing disposition and evidence for each.
• Author and publish the incident response plan, severity matrix, and escalation path, and define “incident” for ratified policy, including insurer and regulatory notification triggers.
• Enforce remediation tracking so that every finding carries an owner and a disposition, and complete mail-flow, quarantine, and anti-impersonation configuration.
• Facilitate cross-functional response during critical incidents, including client technical staff, executives, and third-party providers.
• Define and test monitoring coverage hours and the out-of-hours escalation path, establish a threat hunting cadence, and facilitate tabletop exercises with client stakeholders.

• Build and tune Microsoft Sentinel analytics rules, watchlists, and workbooks, and manage data connectors and detection coverage against a defined threat model.
• Produce the technical evaluation supporting the managed detection sourcing decision, then transition detection onto the chosen platform, running the incumbent service in parallel until the replacement is demonstrably equivalent.
• Design and deploy automated and agentic response playbooks for the highest-volume alert types, with scoped credentials, no standing privilege, and a named human approving any containment that affects production.
• Direct efforts to reduce alert volume and mean time to resolution through tuning, automation, and suppression of validated false positives.
• Evaluate emerging tooling and AI-driven detection and response capability for applicability to client and internal operations.

• Design and operate pilot rings and staged rollouts for every change capable of disrupting access or production workloads.
• Prepare, submit, and present change records to the client's change process, including risk, blast radius, validation steps, and backout plan.
• Execute change during scheduled maintenance windows, including evenings and weekends where the change cannot safely be made during business hours.
• Halt or defer a rollout where validation is incomplete and communicate that decision and its schedule consequence to the engagement lead and the client without delay.

• Bachelor’s degree in Computer Science, Information Security or a related field
• Preferred certifications: AZ-500, SC-200, SC-100, CCSP or CISSP
• 8+ years in infrastructure or security engineering, including 5+ years securing Azure environments
• 4+ years building and tuning Microsoft Sentinel detections (KQL), including Defender XDR and Defender for Cloud
• Hands-on incident response experience, including leading response to critical incidents
• Experience with policy-as-code (Azure Policy, Terraform or Bicep), Microsoft Purview and security automation (Logic Apps or Sentinel playbooks)
• 3+ years in a client-facing consulting role, presenting to technical and executive stakeholders
• Track record of leading high-risk changes through formal change management, using pilots, staged rollouts and rollback plans

This role is open only to candidates who currently live and are authorized to work in the United States. Applications must be submitted from within the U.S. Applications submitted from a location that does not match the candidate’s stated location will not be considered.

Originally posted on Himalayas