Cloud Security Engineer

# Think Data Be Smart #

About Us: DataSmart is a Portuguese company, positioning itself as a consulting company of excellence, with over 20 years of existence. We are specialized in Technologies and Information Systems services for the Portuguese and International markets. We pride ourselves on fostering a culture of involvement, experience, and excellence.

Join our team as a Cloud Security Engineer (Hybrid – Lisbon)

What You’ll Do

• Propose and follow up with engineering teams the necessary improvements to increase the Security Score in Microsoft Defender.
• Design secure multi-subscription and multi-tenant landing zones in Azure and OCI, aligned with the five Well-Architected pillars: Security, Reliability, Performance Efficiency, Operational Excellence, and Cost Optimization.
• Develop container-security reference architectures (AKS, OKE, ACI, OCI Containers, Kubernetes on IaaS) aligned with NIST SP 800-190 and NSA/CISA guidance.
• Map internal and regulatory requirements (PCI DSS, ISO 27001, SOC 2) to Azure Security Benchmark, CIS Azure/OCI 2.0, and other security frameworks.
• Build policy-as-code automation (Azure Policy, OCI Guardrails, Terraform Sentinel, OPA/Gatekeeper) to enforce guardrails and generate auditor-ready evidence.
• Develop and maintain IaC modules (Bicep, Terraform, OCI Resource Manager) with embedded security controls and reusable patterns.
• Integrate IaC static/dynamic scans (Defender for Cloud, Oracle Guard, tfsec, Trivy, Dockle) and container image signing into CI/CD pipelines using GitHub Actions, Azure DevOps or ArgoCD.
• Configure and tune Azure Security Center/Defender, Microsoft Sentinel, and OCI Cloud Guard for threat detection, triage and response.
• Define and maintain KPIs/KRIs and real-time dashboards for cloud posture, vulnerability management and compliance drift.
• Act as a trusted advisor to engineering teams, driving threat-modeling workshops, secure-coding training, and promoting DevSecOps paved-road practices.
• Evaluate emerging cloud security technologies (Confidential Computing, SBOM, attestation frameworks) and present recommendations to the Architecture Review Board.

Qualifications

• 5+ years in infrastructure or security engineering, with at least 5 years focused on public cloud (Azure and/or OCI).
• Hands-on experience improving the Security Score in Defender through advanced configuration of Microsoft Security tools (Defender for Cloud CSPM/CWPP, Defender for Endpoint, Defender for Cloud Apps, DLP, Identity Protection).
• Proven experience delivering secure landing zones at scale, including identity boundaries, micro-segmentation, logging pipelines, data classification and encryption strategies.
• Deep knowledge of Azure Well-Architected Framework, Azure Security Benchmark, CIS Foundations v2.0 (Azure & OCI), NIST SP 800-190, NIST CSF, NIST 800-53, and MITRE ATT&CK for cloud.
• Mastery of Terraform/Bicep, Kubernetes security (RBAC, network policies, PodSecurity Standards), registry hardening, and image signing (Cosign, Notary v2).
• Experience integrating cloud workloads with SIEM/SOAR platforms (Sentinel, Splunk, QRadar) and CSPM solutions (Wiz, Prisma Cloud, Microsoft Defender CSPM).
• Strong scripting/automation skills in PowerShell, Python, Go, or similar.
• Certifications such as AZ-305, AZ-500, OCI Architect Professional, CCSP, CISSP-ISSAP (or equivalent expertise).
• Experience with Oracle Cloud Infrastructure (OCI) is highly valued.
• Portuguese proficiency at a professional level (minimum C1).
• Living in Portugal and available to work in a hybrid model.

At DataSmart, you will have the opportunity to integrate into a solid company and participate in projects of high recognition, nationally and internationally, with an appealing technological environment and career progression.

Excellence in the way to the future!

Connect with Us: Follow us on LinkedIn for updates on career opportunities, company news, and industry insights! For further details, visit us at www.datasmart.pt

#JoinOurTeam #DataSmart #ThinkDataBeSmart #CloudSecurityEngineer #AzureSecurity #OCISecurity #CloudCoE #DevSecOps #MicrosoftDefender #KubernetesSecurity