{"id":3761396,"url":"https://alion.io/job/spektrum-group-cloud-m365-security-engineer","title":"Cloud / M365 Security Engineer","company":{"id":183673,"name":"Spektrum Group","domain":"spektrum-group.com","url":"https://alion.io/company/spektrum-group","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":100,"open_postings":14,"ghost_share":0,"stale_share":0.214,"repost_share":0,"time_to_fill_p50_days":18,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Valencia, Spain"],"countries":["ES"],"hiring_countries":["BG","CZ","HU","IT","PL","RO","ES","GR","PT","SK"],"hiring_countries_total":10,"salary":null,"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"CVSS","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"OneDrive","optional":false},{"name":"SharePoint","optional":false},{"name":"SIEM","optional":false},{"name":"Amazon S3","optional":true},{"name":"AWS","optional":true},{"name":"Hyper-V","optional":true},{"name":"ITIL","optional":true},{"name":"VMWare","optional":true}],"status":"live","first_seen_at":"2026-11-04T14:52:24Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-05T04:28:17Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Spektrum supports apex purchasers (NATO, UN, EU, and National Government and Defence) and their Tier 1 supplier ecosystem with a wide range of specialist services. We provide our clients with professional services, specialised aerospace and defence sales, delivery, and operational subject matter expertise. We are looking for personnel to join our team and support key client projects.\nWho we are supporting \nAt Spektrum, we support a wide range of NATO organizations and programmes by providing highly skilled professionals across defence, security, digital transformation, engineering, and information technology. Our teams contribute to projects that strengthen the Alliance's operational readiness, enhance interoperability between member nations, and enable the delivery of critical capabilities across land, air, maritime, cyber, and space domains.\nFor this opportunity, our client is a private technology company that delivers advanced IT and engineering services in support of NATO programmes. Working alongside NATO stakeholders, the company provides technical expertise, software development, systems integration, and digital solutions that help modernize and sustain mission-critical capabilities. As part of this project, consultants will contribute to the development and support of technologies that underpin NATO's operational effectiveness and long-term digital transformation.\nCloud / M365 Security Engineer \nRole ID:TG-001-3 \nRole Background \nThe Cloud Computing Support - Expert Support (ICT Security Officer) will provide highly specialized ICT security services in support of the client, covering the ICT environment and systems defined in the overarching Service Level Agreement (SLA) between client and the Office, including the management of a dedicated Microsoft 365 tenant. \nServices shall be provided in accordance with applicable ICT governance, standards, and security policies, commensurate with the available capacity to ensure reasonable service coverage (5x8 during defined working hours), complemented by a duty officer modality outside working hours under specifically defined conditions to support and respond to urgent security-specific needs, including incident response. \nExpert Support level: the incumbent shall possess extensive relevant professional experience requiring specialized technical knowledge and skills. He/She will be expected to develop new approaches, techniques, or policies and/or design guidelines and standards of considerable depth that have an impact on the overall execution of programmes or services of a function or various interrelated areas. Expected outputs at this level include, inter alia, highly specialized technical security support and project-wide proposals. \nService Scope \nCloud & Collaboration Environment \nMicrosoft 365 tenant: Exchange Online, SharePoint Online, OneDrive, Teams, and associated collaboration workloads. \nMicrosoft Entra ID (Azure AD): identities, authentication, conditional access, and privileged accounts within the covered tenant. \nMicrosoft Defender XDR suite: Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps, and Defender for Identity, as deployed. \nMicrosoft Purview and related compliance, audit, and data-protection capabilities, as applicable. \nSecurity Monitoring & Response Systems \nDesignated ICT security systems and services generating security reports and alerts for the covered environment. \nThreat intelligence sources and platforms relevant to the covered environment. \nVulnerability identification and assessment capabilities applicable to the covered ICT environment and systems. \nResilience & Recovery \nOperational Resilience (OR) controls implemented and maintained by relevant operations teams across the covered ICT environment and systems. \nDisaster recovery plans and Disaster Recovery Exercises (DRX) performed by the respective operations teams. \nTechnical Knowledge \nMicrosoft 365 & Cloud Security \nIn-depth expertise in Microsoft 365 security administration: Microsoft Defender XDR, Defender for Office 365 (anti-phishing, safe links/attachments, mail-flow protection), and Defender for Endpoint. \nMicrosoft Entra ID security: identity protection, risky sign-in/user investigation, conditional access design, MFA enforcement, and privileged identity management. \nInvestigation and remediation of compromised accounts, suspicious e-mails, business e-mail compromise (BEC), and other cloud-borne threats. \nMicrosoft Sentinel or equivalent cloud SIEM/SOAR platforms: analytics rules, incident triage, automation/playbooks, and watchlists. \nAdvanced hunting using Kusto Query Language (KQL) and other environment-specific threat-hunting capabilities. \n\nSecurity Operations & Incident Response \nSecurity incident response methodologies aligned with recognized frameworks (e.g., NIST SP 800-61), including containment, eradication, and recovery. \nDigital forensics analysis: evidence collection and preservation, log and artifact analysis, and root-cause determination for cloud and hybrid environments. \nDesign, documentation, and continuous improvement of detection and response methods, procedures, runbooks, and tooling. \nThreat intelligence handling: collection, analysis, sharing, and coordination of recommended mitigation measures (e.g., MITRE ATT&CK mapping, IOC management). \n\nVulnerability & Risk Management \nSecurity assessment of ICT environments and systems throughout their life cycle, including configuration reviews against security baselines and benchmarks (e.g., CIS, Microsoft Secure Score). \nVulnerability verification, prioritization (e.g., CVSS-based), remediation guidance, and validation of corrective measures. \nPreparation of security advisories, notifications, and remediation recommendations referencing relevant security updates. \nGovernance, Advisory & Awareness \nSecurity architecture and configuration-baseline advisory for system design, development, and modification in alignment with applicable architectural standards and security policies. \nDevelopment of security guidelines, standards, and policy inputs with organization-wide impact, consistent with the Expert Support level. \nPreparation of end-user security awareness materials and support to awareness campaigns. \nSecurity reporting within established governance and reporting frameworks, including incident and status reporting. \n\nResilience & Recovery \nIdentification and assessment of Operational Resilience (OR) controls commensurate with business requirements. \nDisaster recovery planning, coordination, and support to Disaster Recovery Exercises (DRX). \nRole Duties and Responsibilities \nThe ICT Security Officer will perform, but not be limited to, the following duties in accordance with applicable ICT governance, standards, and security policies: \nMonitor, verify, and escalate security reports and alerts generated by designated ICT security systems and services. \nMonitor and respond to Microsoft 365 security incidents, including compromised accounts, suspicious e-mails, and other threats affecting the tenant. \nConduct proactive threat-hunting activities using environment-specific capabilities, including M365 security tools and other relevant technologies, as appropriate. \nEstablish, document, and maintain methods, procedures, and tools appropriate to the environment to support threat detection and response. \nPerform security incident response activities, including forensics analysis, and coordinate and advise on appropriate response measures for incidents detected by the team or reported/escalated to it from other sources. \nMonitor, share, and act on relevant threat intelligence, and coordinate the implementation of recommended measures where applicable to minimize exposure to associated risks. \nPerform regular security assessments of the ICT environment and systems throughout their life cycle (as appropriate) to identify potential security issues, provide guidance on effective remediation, and help minimize risk exposure. \nIssue security advisories and notifications to alert relevant operational teams to vulnerabilities affecting ICT systems, providing remediation recommendations including references to relevant security updates to effectively and promptly reduce exposure to associated risks. \nVerify vulnerabilities reported through various sources, notify relevant teams, provide appropriate recommendations for prompt remediation, and confirm the effectiveness of implemented corrective measures. \nProvide security-specific advice to operations teams to support system design, development, modification, and security configuration baselines in alignment with applicable architectural standards and security policies. \nPrepare and issue end-user awareness materials and support awareness initiatives to strengthen users' ability to recognize and respond appropriately to security threats. \nPrepare reports and provide regular updates on security-related issues, including incidents, in accordance with the established governance and reporting framework. \nIdentify Operational Resilience (OR) controls for implementation and maintenance by the relevant operations teams across the covered ICT environment and systems, commensurate with business requirements, and perform OR assessments to verify correct implementation. \nSupport Disaster Recovery Exercises (DRX) performed by the respective operations teams and coordinate the implementation of disaster recovery plans. \nParticipate in the duty officer modality outside defined working hours, under specifically defined conditions, to support and respond to urgent security-specific needs, including incident response. \nEssential Skills, Experience and Certifications \nEssential Skills: \nMinimum 7-10 years of progressively responsible experience in ICT security roles, of which at least 3 years in cloud security operations for Microsoft 365 / Azure environments in enterprise or mission-critical settings. \nDemonstrated expert-level experience in security monitoring, incident response, and digital forensics, including response to compromised accounts, phishing/BEC, and other cloud-borne threats. \nProven hands-on experience with the Microsoft Defender XDR suite, Microsoft Entra ID security capabilities, and Microsoft Sentinel or equivalent SIEM/SOAR platforms, including advanced hunting (KQL). \nDemonstrated experience in threat intelligence handling, vulnerability management, and security assessments across the system life cycle. \nDemonstrated ability to develop methods, procedures, guidelines, standards, or policies with organization-wide impact, consistent with the Expert Support level. \nMicrosoft Certified: Security Operations Analyst Associate (SC-200) or equivalent \nCISSP, CISM, GIAC (e.g., GCIH, GCFA), or equivalent recognized security certification. \nFluency in English, both written and oral, is required. \nDesirable Skills: \nExperience with Hyper Converged Infrastructure or Software Defined Storage solutions is an advantage. \nGood presentation skills and ability to convey complex technical information to non-technical audience \nExperience with service reporting and business analytics \nExperience with cloud storage solutions (e.g., AWS S3, Azure Blob Storage) \nExperience with virtualization technologies (e.g., VMware, Hyper-V) \nExperience supporting operational resilience, disaster recovery planning, and disaster recovery exercises is highly desirable. Experience in UN, NGO, peacekeeping, or international mission environments is highly desirable. \n\nMicrosoft Certified: Cybersecurity Architect Expert (SC-100) or Azure Security Engineer Associate (AZ-500) \nCompTIA Security+ / CySA+ \nITIL Foundation \nWorking Location: \nOn-site from Valencia, Spain or Brindisi, Italy. \nRemote work is restricted to Poland, Romania, Czech Republic, Hungary, Portugal, Greece, Slovakia and Bulgaria.","description_format":"text","description_chars":11851,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Bulgaria","iso":"BG","kind":"country"},{"name":"Czech Republic","iso":"CZ","kind":"country"},{"name":"Hungary","iso":"HU","kind":"country"},{"name":"Italy","iso":"IT","kind":"country"},{"name":"Poland","iso":"PL","kind":"country"},{"name":"Romania","iso":"RO","kind":"country"},{"name":"Spain","iso":"ES","kind":"country"},{"name":"Greece","iso":"GR","kind":"country"},{"name":"Portugal","iso":"PT","kind":"country"},{"name":"Slovakia","iso":"SK","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Management Consulting"],"lifecycle":[{"event":"open","at":"2026-11-04T18:41:12Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":18,"reasons":["conf:0","win:early"],"computed_at":"2026-11-05T05:03:41Z"},"pay":null,"html_url":"https://alion.io/job/spektrum-group-cloud-m365-security-engineer","json_url":"https://alion.io/job/spektrum-group-cloud-m365-security-engineer.json","meta":{"generated_at":"2026-11-05T05:03:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6090,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-06T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":183673},"rest":"https://alion.io/mcp/rest/get_company?id=183673"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fspektrum-group-cloud-m365-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fspektrum-group-cloud-m365-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fspektrum-group-cloud-m365-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/spektrum-group-cloud-m365-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fspektrum-group-cloud-m365-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3761396}},{"tool":"search_jobs","arguments":{"company":"spektrum-group.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3761396},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}