What you will be doing:

SIEM integration: Integrate cloud and Kubernetes audit, identity, network and workload telemetry into the SIEM. Configure collection permissions, routing, parsing, normalization and enrichment. Validate event coverage end to end and manage log access, retention and ingestion costs.
Security service reliability: Operate assigned security tools, collectors and integration pipelines. Define service-level objectives, monitor availability, ingestion latency and capacity and detect missing or unusable data. Maintain upgrades, recovery procedures and automation that reduces recurring operational work.
Cloud asset discovery: Automate discovery of cloud resources, managed services and configuration changes across accounts, projects, subscriptions and regions. Maintain visibility of ownership, service dependencies and assessment coverage, including newly deployed resources and monitoring gaps.
Cloud security posture: Assess effective IAM permissions, public exposure, network controls, storage and database access, encryption, key management, secrets and logging. Use cloud-native services, APIs and posture-management tools to validate findings and prioritize risks based on exposure and business impact.
Kubernetes security: Assess and harden clusters and workloads with platform owners. Improve access controls, workload identities, admission controls, network isolation and secrets protection. Integrate container image scanning and runtime security monitoring and coordinate vulnerability remediation and security updates.
Automation and remediation: Implement security baselines, configuration-drift checks and preventive controls through scripts, infrastructure as code and CI/CD. Deliver changes through testing, peer review and rollback planning. Track findings with service owners and verify remediation before closure.
Detection and incident support: Work with security operations to test and tune cloud detections, investigate cloud and Kubernetes incidents and complete root-cause reviews. Maintain actionable dashboards, technical evidence and runbooks and participate in agreed incident escalation arrangements.

What we are looking for:

Experience: At least 3 years of relevant experience in SRE, DevOps, cloud/platform engineering or security engineering, including at least 2 years implementing and troubleshooting security controls in production cloud environments.
Cloud security: Strong hands-on experience with at least one of GCP, AWS or Microsoft Azure and working knowledge of a second. Experience investigating configurations, permissions and exposure using cloud APIs, native security services or cloud security posture management (CSPM) tools. Expertise in all three platforms is not required.
Kubernetes: Experience operating and securing production Kubernetes environments such as GKE, EKS or AKS. Practical understanding of RBAC, service accounts, workload identity, Pod Security Standards, admission controls, network policies, secrets and container security.
SIEM engineering: Hands-on experience integrating cloud telemetry with at least one SIEM, including source configuration, collection permissions, event processing and investigation queries. Able to troubleshoot the complete path from event generation to searchable data.
Automation: Proficiency in Python or an equivalent programming language, cloud APIs/SDKs and Terraform or similar infrastructure-as-code tooling. Experience with Git and CI/CD to deliver maintainable, tested and reviewed automation.
SRE fundamentals: Strong Linux and networking troubleshooting skills, including DNS, TLS and connectivity. Experience with monitoring, alerting, incident response and safe production changes. Familiarity with service-level indicators and objectives.
Ownership and communication: Able to independently investigate issues, distinguish actionable risks from unvalidated findings and coordinate remediation across teams. Clear technical documentation and communication skills. A relevant degree or equivalent practical experience is welcome.