Cloud Security Engineering Lead

About the role

KAUST is running a Cybersecurity Transformation Program focused on secure cloud and hybrid environments across its multi-cloud setups, emphasizing modern security architectures, Zero Trust and sustainable operational handover. It is seeking a hands-on Cloud Security Engineering Lead who designs, implements and assures secure cloud and hybrid environments, combining solution architecture with direct technical execution across cloud security, identity, endpoint, security operations, Zero Trust and modern workplace security. The role works across several portfolio initiatives, starting with Microsoft 365 A5, alongside Enterprise IAM, cloud security posture improvement, security operations integration, network security and segmentation, cyber exposure reduction and related modernization efforts.

Key responsibilities

• Own cloud security architecture and engineering across assigned initiatives, from design through implementation, stabilization and operational handover.
• Assess Azure, Microsoft 365, hybrid and multicloud environments to identify security gaps, technical dependencies and opportunities for control improvement.
• Design and implement secure cloud architectures aligned with KAUST security principles, enterprise architecture standards and Zero Trust objectives.
• Provide hands-on engineering for Microsoft Entra ID, Conditional Access, Privileged Identity Management, Identity Protection, MFA and passwordless controls, Intune, Defender XDR, Defender for Cloud, Microsoft Sentinel, Microsoft Purview and related capabilities.
• Improve cloud security posture management, workload protection, attack-path reduction, logging, monitoring and security configuration across IaaS, PaaS, SaaS, endpoint and identity environments.
• Integrate cloud platforms with Security Operations, including SIEM/SOAR telemetry, detection use cases, KQL analytics, incident automation, threat intelligence and operational monitoring.
• Apply Zero Trust principles across identity, privileged access, endpoints, applications, network access, collaboration and data.
• Work with network security teams on segmentation, firewalling, secure remote access, private connectivity, DNS and related controls.
• Lead technical design, configuration reviews, proof-of-concept, testing, troubleshooting and remediation, and review proposals from Microsoft, cloud providers and delivery partners.
• Lead or support migration from legacy security platforms to cloud-native capabilities, and manage dependencies with Enterprise IAM, Saviynt IGA, network security, security operations, endpoint management, infrastructure and application teams.
• Contribute to the Microsoft 365 A5 project, including architecture, security configuration, Defender, Entra, Intune, Purview, security operations integration, Copilot security controls, testing, pilot readiness and technical handover.