Cloud Security Senior Consultant

Devoteam Cyber Trust is the Cybersecurity specialist arm of the Devoteam Group.
With our 800+ experts located across EMEA, we aim to establish cybersecurity as an enabler of business success rather than a gatekeeper.
We leverage an end‐to‐end approach to Cyber Resilience, Applied Security, and Managed Security services to secure the tech journey of large and medium‐size companies from all sectors and industries.
Since **, previously known as INTEGRITY, our team based in Portugal is specialised in providing cutting‐edge Managed Security Services that combine its expertise and proprietary technology to consistently and effectively reduce the cyber risk of our clients.
The comprehensive service range includes Persistent Intrusion Testing, ISO *, PCI‐DSS, GRC Consulting and Solutions, and Third‐Party Risk Management.
ISO * (Information Security) and ISO ** (Quality) certified, PCI‐QSA, and member of CREST and CIS - Centre for Internet Security, we provide services to a considerable number of clients, operating in more than 20 countries.
Job Description We're building a new Cloud Security Practice that delivers outcome‐driven security engagements across Microsoft Azure, Microsoft 365, Google Cloud, AWS, and partner CNAPP platforms.
What You'll Do Deliver cloud security engagements end‐to‐end with a Microsoft focus: Sentinel deployments, Defender XDR rollouts, Defender for Cloud implementations, detection engineering, threat hunting, incident response support, posture assessments, Azure security reviews, identity security improvements, cloud hardening.
Write KQL, tune analytics rules, build connectors, configure Defender XDR policies, and walk customers through what their telemetry, posture, exposure, and risks mean.
Assess and improve security controls across Sentinel, Defender XDR, Defender for Cloud, Entra ID, Azure workloads, logging/monitoring, and privileged access.
Translate cyber security requirements into practical configurations, remediation actions, detection use cases, and operational improvements.
Support multi‐cloud engagements (Google Cloud, AWS) and CNAPP‐related work where the customer needs posture improvement, exposure reduction, or detection coverage.
Run customer‐facing workshops and build the reusable assets the practice will scale on: playbooks, deliverable templates, KQL libraries, detection rule packs, configuration baselines, hardening guides, remediation roadmaps.
Qualifications Microsoft Sentinel Deployed or supported Sentinel in production for at least one enterprise customer.
Writes KQL from scratch for analytics rules, hunting queries, investigations, and workbooks.
Has built, tuned, or maintained analytics rules, scheduled queries, hunting queries, or incident workflows.
Has worked with data connectors, including Microsoft and non‐Microsoft sources.
Has experience with automation rules, Logic Apps playbooks, or response workflows.
Understands alert fatigue and has experience improving signal‐to‐noise in a SOC or monitoring environment.
Defender XDR cross‐pillar Configured and operated Defender for Endpoint, Identity, Office 365, and Cloud Apps.
Investigated incidents spanning multiple pillars using the unified incident model.
Comfortable with advanced hunting across the Defender XDR schema.
Understands how Defender XDR and Sentinel complement each other in detection and response.
Azure and cloud security Solid Azure security understanding from a cyber perspective, not just infrastructure.
Has delivered Azure security assessments, posture improvement, hardening, or secure configuration reviews.
Hands‐on with Microsoft Defender for Cloud — recommendations, regulatory compliance, workload protection, posture management.
Understands subscriptions/management groups, Azure Policy, RBAC, logging/monitoring, network exposure, and workload protection.
Comfortable working in broader cloud security contexts: posture management, workload protection, misconfiguration review, exposure reduction.
Identity and access Strong Microsoft Entra ID security — MFA, Conditional Access, Identity Protection, access reviews, enterprise applications, service principals.
Familiarity with PIM, RBAC, least privilege, break‐glass accounts, access governance.
Understands identity as a core cloud security control.
Cloud security and CNAPP awareness Understands CSPM, CWPP, attack paths, misconfiguration abuse, and cloud‐specific attack patterns.
Familiar with CNAPP concepts and tools.
Can turn cloud security findings into practical remediation plans for security, cloud, and engineering teams.
Delivery experience 5+ years cybersecurity experience, including relevant experience with the Microsoft security stack in a delivery, consulting, cloud security, detection engineering, or senior SOC role.
Experience delivering client‐facing cyber security work, including asse