Devoteam Cyber Trust | Lead Cloud Security Consultant — Microsoft Focus

We're building a new Cloud Security Practice that delivers outcome-driven security engagements across Microsoft Azure, Microsoft 365, Google Cloud, AWS, and partner CNAPP platforms.

We're hiring a Lead Cloud Security Consultant — Microsoft Focus as a hands-on cyber security expert. You'll help design how we deliver engagements, execute them in the consoles, and build the reusable assets the practice will scale on.

This is a cyber-first role with Microsoft as the primary stack. Microsoft Sentinel, Defender XDR, Defender for Cloud, and Entra ID are the core of the work, but you should be comfortable operating in broader cloud security contexts — multi-cloud posture, CNAPP findings, exposure reduction — when engagements call for it. You don't need to be a pure infrastructure engineer, but you should understand cloud environments well enough to identify security gaps, implement controls, and help customers improve their posture.

What you'll do

• Deliver cloud security engagements end-to-end with a Microsoft focus: Sentinel deployments, Defender XDR rollouts, Defender for Cloud implementations, detection engineering, threat hunting, incident response support, posture assessments, Azure security reviews, identity security improvements, cloud hardening.

• Write KQL, tune analytics rules, build connectors, configure Defender XDR policies, and walk customers through what their telemetry, posture, exposure, and risks mean.

• Assess and improve security controls across Sentinel, Defender XDR, Defender for Cloud, Entra ID, Azure workloads, logging/monitoring, and privileged access.

• Translate cyber security requirements into practical configurations, remediation actions, detection use cases, and operational improvements.

• Support multi-cloud engagements (Google Cloud, AWS) and CNAPP-related work where the customer needs posture improvement, exposure reduction, or detection coverage.

• Run customer-facing workshops and build the reusable assets the practice will scale on: playbooks, deliverable templates, KQL libraries, detection rule packs, configuration baselines, hardening guides, remediation roadmaps.

Microsoft Sentinel:

• Deployed or supported Sentinel in production for at least one enterprise customer.

• Writes KQL from scratch for analytics rules, hunting queries, investigations, and workbooks.

• Has built, tuned, or maintained analytics rules, scheduled queries, hunting queries, or incident workflows.

• Has worked with data connectors, including Microsoft and non-Microsoft sources.

• Has experience with automation rules, Logic Apps playbooks, or response workflows.