Senior Network Security Engineer

The Senior Network Security Engineer will serve as the technical owner of the organization’s cloud and Microsoft 365 security posture, with a primarily hands-on focus on engineering, configuring, and administering cloud-native security controls independently, without reliance on service providers. The role will focus on Entra ID, Defender XDR, and email and endpoint encryption, alongside hands-on management of NDR, DLP, PAM, PAW, WAF, SASE, and database security solutions. Key responsibilities include securing Microsoft and Oracle applications, hardening Windows/Linux systems and network infrastructure, conducting risk assessments, addressing audit findings, providing cybersecurity advisory, and leading security implementation projects.

Responsibilities

• Solely implement, administer, and manage (out-of-the-box, no service-provider involvement): Azure Entra Suite (IAM), Microsoft Defender for Endpoint/Servers (EDR/XDR), email encryption, and endpoint encryption.
• Implement and monitor security best practices for Entra ID, Exchange Online/on-prem, SharePoint, and hybrid Active Directory.
• Manage, operate, and conduct configuration reviews of NDR, DLP, PAM, PAW, WAF, SASE, and database security tools.
• Secure and harden Microsoft and Oracle applications, and Windows/Linux operating systems.
• Strengthen network device configurations against CIS and NIA QCF 2022 and implement secure network architecture.
• Provide continuous cybersecurity advisory and risk assessment strategy support; assist with security product evaluation and service provider selection.
• Drive cybersecurity programs to close gaps identified by internal/external auditors, including NCSA; lead security solution implementation projects and manage vendors.
• Travel to datacenter and client locations as required; provide on-call incident support outside business hours as needed.

Qualifications

Experience Required:

• 8–10 years of experience in cloud/cybersecurity engineering, operations, and advisory.
• Proven hands-on administration of Entra ID, Defender XDR, and email/endpoint encryption without vendor support.
• Hands-on experience with NDR, DLP, PAM, PAW, WAF, SASE, and database security tools.
• Experience hardening Microsoft/Oracle applications and Windows/Linux systems, including audit remediation (NCSA).
• Willingness and ability to travel to data center/client locations and provide on-call support as required.

Required Certifications:

• Microsoft SC-300 (Identity and Access Administrator) – Entra ID/Entra Suite.
• Microsoft SC-200 (Security Operations Analyst) – Defender XDR (MDE/MDS).
• Microsoft SC-100 (Cybersecurity Architect Expert).
• Microsoft AZ-500 (Azure Security Engineer Associate).
• CISSP (Certified Information Systems Security Professional).
• NDR platform certification (e.g., Vectra, Darktrace, or ExtraHop Certified Administrator).
• DLP certification (e.g., Microsoft Purview DLP or Symantec/Broadcom DLP Administrator).
• PAM certification (e.g., CyberArk Defender/Sentry or BeyondTrust Certified Administrator) – covering PAM and PAW.
• WAF certification (e.g., F5 Certified BIG-IP Administrator, Imperva, or Cloudflare WAF).
• SASE certification (e.g., Zscaler ZDTA/ZIA or Palo Alto Prisma SASE).
• Database security certification (e.g., Oracle Database Security or Imperva Data Security).

Preferred Certifications: CISM, CCSP, CEH.

All certifications must be current. Equivalent recognized credentials may be considered subject to approval.

Primary Focus:

• Administration of Entra ID, Defender XDR, and email/endpoint encryption without vendor support.
• Hands-on experience across NDR, DLP, PAM, PAW, WAF, SASE, and database security tooling.