Sales Security Engineer

We are hiring a Senior Security Engineer based in London to join our Cloud Architecture team, focused on security configuration and identity security across client and internal platforms. This role leads the design and implementation of secure-by-default patterns for identity, access, and configuration in Microsoft Entra ID (Azure AD), Okta, Microsoft 365, Google Workspace, and AWS IAM Identity Center, with strong API/SCIM and ServiceNow integration.

Responsibilities

Design and implement identity and access controls across Entra ID, Okta, M365, Google Workspace, and AWS IAM Identity Center to raise control coverage and reduce account compromise risk.; Define and enforce conditional access, MFA, and passwordless strategies to achieve target adoption rates (e.g., 100% for employees, >95% for contractors/partners).; Google Workspace: OAuth app controls, context-aware access, DLP, secure default sharing.; Entra ID: conditional access baselines, tenant restrictions, enterprise app consent policies, token protections.; AWS IAM Identity Center: permission set design, assignment governance, session duration, access portal controls, SCIM provisioning hygiene.; Build automation using SCIM, platform APIs, and ServiceNow workflows to meet JML SLAs (e.g., provision within hours; deprovision within minutes of HR termination).; Establish policy-as-code guardrails and configuration baselines; integrate checks into CI/CD and change pipelines to prevent drift.; Migrate legacy federation (e.g., ADFS) to modern SSO; consolidate directories and domains to reduce complexity and standing privilege.; Harden admin boundaries, IAM roles, secrets, and privileged access with JIT elevation; track reductions in permanent admin accounts and unused privileged roles.; Integrate identity logs (Entra ID, Okta, M365, AWS CloudTrail/Identity Center) into Microsoft Sentinel; build analytics rules and SOAR playbooks to improve alert quality and reduce MTTR.; Develop identity-focused detections and response playbooks (impossible travel, MFA fatigue, anomalous OAuth consent, risky AWS access patterns) and continuously tune to reduce false positives.; Run and improve vulnerability/risk management for identity-linked exposures (weak policies, stale accounts, risky app consent, over-permissive permission sets) with prioritization, remediation partnerships, and SLAs.; Lead or support incident response for identity-related events; drive post-incident learning, control improvements, and documentation updates.; Partner with engineering and EUC teams to embed secure-by-default patterns, simplify developer/user experiences, and reduce helpdesk burden.; Map controls to ISO 27001, NIST CSF, SOC 2, CIS Benchmarks, GDPR, and SIEM/SOAR operational requirements; support audits with evidence and runbooks.; Write clear standards, architecture documents, integration guides, and operational runbooks; present designs at design authority and stakeholder forums.; Measure and report risk reduction (e.g., dormant account reduction %, privileged role minimization, policy coverage) and track progress against agreed KPIs and roadmaps.

Requirements

Well versed in identity/access security engineering or architecture within enterprise environments.; Hands-on expertise hardening Microsoft Entra ID (Azure AD), Google Workspace Admin, and AWS IAM Identity Center configurations, plus Okta, Microsoft 365, and Active Directory/Entra Connect.; Proven delivery of SSO/MFA/conditional access programs; experience with passwordless and strong authentication methods.; Strong experience with SCIM and API-based integrations for JML automation; ServiceNow access workflows, approvals, and attestation.; Privileged access management (Entra PIM/Okta) and admin boundary hardening; permission set governance in AWS IAM Identity Center.; Experience decommissioning legacy federation (e.g., ADFS) and consolidating identity platforms.; Scripting/coding for automation and configuration (PowerShell and/or Python; Okta Workflows).; Threat modeling and architecture review focused on identity misuse, consent abuse, token/session risks, and cloud account takeover.; SIEM/SOAR integration experience, ideally with Microsoft Sentinel (data connectors incl. Entra, M365, Okta, AWS CloudTrail), analytics rules, playbooks, and incident workflows.; Effective collaboration with platform/EUC/security ops/data engineering; clear written and verbal communication.

Nice to have

Broader Azure and AWS security architecture experience (Defender for Cloud Apps, AWS Organizations/Control Tower, SCPs); Secrets management (Azure Key Vault, HashiCorp Vault) and app-to-app auth patterns; Integration of identity telemetry with broader SIEM/SOAR ecosystems; purple-team/attack path reduction for identity; Compliance program experience (ISO 27001, SOC 2, NIST CSF, GDPR) and audit support; Consulting or client-facing delivery experience in complex, multi-tenant contexts; Relevant certifications (e.g., Okta Certified Professional, Microsoft/Azure security, AWS Security Specialty, CISSP, CCSP, BCS/TOGAF)

Benefits

competitive medical, group retirement plans, vision, and dental insurance; significant paid time off; preferential partner discounts; employee mental health awareness days; employee resource groups; in-office events