{"id":3860156,"url":"https://alion.io/job/fortellar-remote-sr-security-engineer-cloud-security-detection","title":"REMOTE - Sr. Security Engineer - Cloud Security & Detection","company":{"id":676107,"name":"Fortellar","domain":"fortellar.com","url":"https://alion.io/company/fortellar","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Rippling","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":140000,"max":160000,"currency":"USD","period":"year","gross":null,"usd_annual":160000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"Bicep","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"Terraform","optional":false}],"status":"live","first_seen_at":"2026-11-06T06:19:08Z","employer_posted_date":null,"last_verified_at":"2026-11-06T06:19:08Z","board_verified":false,"closed_at":null,"days_open":1,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":1},"description":"About Fortellar\n\nWe are a boutique IT consulting and business process outsourcing organization supporting mid to enterprise-level organizations. We are a small, but mighty, team of experts who know how to stretch, adapt, and put on any hat required in the moment to make our clients successful and enable Fortellar’s growth. Keys to success at Fortellar include:\n\nCollaboration: You demonstrate excellence in remote collaboration across your Fortellar and client teams. \n\nGrowth Mindset: You embrace personal growth and are always learning new things to support your team, your clients, and your personal goals. \n\nClient Success: You have a passion for your client’s success – you don’t just deliver to the contract you ensure that your client’s goals and needs are met.\n\nHumanity First: Honest and transparency are your natural instincts – your actions speak louder than your words and your team members love working with you.\n\nEntrepreneurial: You find a way to get it done, no matter what the challenges or seeming blockers are in front of you\n\nJob Description Summary\nThe Sr. Security Engineer, Cloud Security & Detection designs, deploys, and operates cloud security posture, data protection, and detection and response capability for Fortellar's clients, with primary assignment to large-scale, multi-workstream security remediation engagements. The role is typically responsible for closing the largest single pool of open findings in the client estate, and for transitioning detection and data security capability off incumbent external vendors and onto the Microsoft platform the client already licenses. Engagements involve cloud estates carrying substantial backlogs of open posture findings, together with Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Defender XDR, and Microsoft Purview.\n\nThis is a hands-on engineering role with direct client exposure. The engineer is accountable for standing up a detection capability that must be proven equivalent to an incumbent managed service before that service is decommissioned, and for clearing an incident backlog in an environment where no response process previously operated. The role requires deep Azure and Microsoft security platform expertise, real incident response experience, strong verbal and written communication, and the professional presence to represent Fortellar credibly in front of client technical staff and executives, both in person and virtually.\n\nMust be able to travel 10% - 20% to client sites\n\nCloud Security Posture Engineering\n\nAssign a named owner and a closure date to every open cloud finding, and review all standing exemptions, revoking those without a written rationale and an expiry date.\n\nEliminate anonymous and public access from internet-facing cloud resources, including enabling authentication on function applications and removing public access from storage accounts.\n\nRotate and remove verified secrets embedded in cloud resources, and disable shared-key access across storage accounts, prioritizing those holding sensitive data.\n\nEstablish private link connectivity, network rules, and network security group coverage as platform standards, and adopt managed identity for web applications and functions.\n\nRoute diagnostic and platform logging into Microsoft Sentinel, and manage ingestion scope and cost against the agreed platform budget.\n\nImplement landing-zone guardrails as policy-as-code so that remediated configuration cannot regress, and review identified attack paths on a monthly cadence.\n\nSecurity Operations and Incident Response\n\nTriage and close the standing backlog of high-severity security incidents, establishing disposition and evidence for each.\n\nAuthor and publish the incident response plan, severity matrix, and escalation path, and define “incident” for ratified policy, including insurer and regulatory notification triggers.\n\nEnforce remediation tracking so that every finding carries an owner and a disposition, and complete mail-flow, quarantine, and anti-impersonation configuration.\n\nFacilitate cross-functional response during critical incidents, including client technical staff, executives, and third-party providers.\n\nDefine and test monitoring coverage hours and the out-of-hours escalation path, establish a threat hunting cadence, and facilitate tabletop exercises with client stakeholders.\n\nDetection Engineering and Automation\n\nBuild and tune Microsoft Sentinel analytics rules, watchlists, and workbooks, and manage data connectors and detection coverage against a defined threat model.\n\nProduce the technical evaluation supporting the managed detection sourcing decision, then transition detection onto the chosen platform, running the incumbent service in parallel until the replacement is demonstrably equivalent.\n\nDesign and deploy automated and agentic response playbooks for the highest-volume alert types, with scoped credentials, no standing privilege, and a named human approving any containment that affects production.\n\nDirect efforts to reduce alert volume and mean time to resolution through tuning, automation, and suppression of validated false positives.\n\nEvaluate emerging tooling and AI-driven detection and response capability for applicability to client and internal operations.\n\nChange Management and Operational Safety\n\nDesign and operate pilot rings and staged rollouts for every change capable of disrupting access or production workloads.\n\nPrepare, submit, and present change records to the client's change process, including risk, blast radius, validation steps, and backout plan.\n\nExecute change during scheduled maintenance windows, including evenings and weekends where the change cannot safely be made during business hours.\n\nHalt or defer a rollout where validation is incomplete and communicate that decision and its schedule consequence to the engagement lead and the client without delay.\n\nExperience and Education\n\nBachelor’s degree in Computer Science, Information Security or a related field\n\nPreferred certifications: AZ-500, SC-200, SC-100, CCSP or CISSP\n\n8+ years in infrastructure or security engineering, including 5+ years securing Azure environments\n\n4+ years building and tuning Microsoft Sentinel detections (KQL), including Defender XDR and Defender for Cloud\n\nHands-on incident response experience, including leading response to critical incidents\n\nExperience with policy-as-code (Azure Policy, Terraform or Bicep), Microsoft Purview and security automation (Logic Apps or Sentinel playbooks)\n\n3+ years in a client-facing consulting role, presenting to technical and executive stakeholders\n\nTrack record of leading high-risk changes through formal change management, using pilots, staged rollouts and rollback plans\n\nThis role is open only to candidates who currently live and are authorized to work in the United States. Applications must be submitted from within the U.S. Applications submitted from a location that does not match the candidate’s stated location will not be considered.\n\nOriginally posted on Himalayas","description_format":"text","description_chars":7026,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","IT Consulting & Digital Transformation"],"lifecycle":[{"event":"open","at":"2026-11-06T08:48:30Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":30,"reasons":["seen:0","win:early"],"computed_at":"2026-11-07T05:47:08Z"},"pay":{"stated_usd_annual":160000,"is_top_pay":false},"html_url":"https://alion.io/job/fortellar-remote-sr-security-engineer-cloud-security-detection","json_url":"https://alion.io/job/fortellar-remote-sr-security-engineer-cloud-security-detection.json","meta":{"generated_at":"2026-11-07T13:10:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15576,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-08T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":676107},"rest":"https://alion.io/mcp/rest/get_company?id=676107"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffortellar-remote-sr-security-engineer-cloud-security-detection"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffortellar-remote-sr-security-engineer-cloud-security-detection"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffortellar-remote-sr-security-engineer-cloud-security-detection"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/fortellar-remote-sr-security-engineer-cloud-security-detection\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffortellar-remote-sr-security-engineer-cloud-security-detection"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3860156}},{"tool":"search_jobs","arguments":{"company":"fortellar.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3860156},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}