Cloud Security Engineering Lead

About KAUST

KAUST (King Abdullah University of Science and Technology) is currently implementing a Cybersecurity Transformation Program. This program focuses on securing cloud and hybrid environments across its multi-cloud infrastructure. The initiative emphasizes modern security architectures, Zero Trust principles, and sustainable operational handover, involving close collaboration with internal teams and delivery partners to enhance security operations, cloud security posture, identity management, and network security.

The Role

KAUST is seeking a Cloud Security Engineering Lead to design, implement, and assure secure cloud and hybrid environments across its multi-cloud infrastructure. This full-time role, based in Thuwal, Makkah, combines solution architecture with direct technical execution across various security domains, including cloud security, identity, endpoint, security operations, Zero Trust, and modern workplace security. The incumbent will translate security requirements into deployable technical controls, lead complex implementation activities, resolve cross-platform dependencies, and ensure solutions are operationally supportable and measurable. This role spans multiple portfolio initiatives, including a major project involving Microsoft 365 A5, Enterprise IAM, cloud security posture improvement, security operations integration, network security and segmentation, and cyber exposure reduction efforts. The engineer is expected to maintain a hands-on approach in design, configuration, integration, troubleshooting, testing, remediation, and knowledge transfer, while also providing technical direction to partners and internal teams.

Key Responsibilities

• Lead cloud security architecture and engineering activities for assigned initiatives within the Cybersecurity Transformation Program, from design through implementation, stabilization, and operational handover.
• Assess Azure, Microsoft 365, hybrid, and multi-cloud environments to identify security gaps, technical dependencies, and opportunities for control improvement.
• Design and implement secure cloud architectures aligned with KAUST security principles, enterprise architecture standards, operational requirements, and Zero Trust objectives.
• Provide hands-on engineering across Microsoft Entra ID, Conditional Access, Privileged Identity Management, Identity Protection, MFA and passwordless controls, Intune, Defender XDR, Defender for Cloud, Microsoft Sentinel, Microsoft Purview, and related Microsoft security capabilities.
• Engineer and improve cloud security posture management, workload protection, attack-path reduction, logging, monitoring, and security configuration across IaaS, PaaS, SaaS, endpoint, and identity environments.
• Design and implement integrations between cloud platforms and Security Operations, including SIEM/SOAR telemetry, detection use cases, KQL analytics, incident automation, threat intelligence, and operational monitoring requirements.
• Apply Zero Trust principles across identity, privileged access, endpoints, applications, network access, collaboration, and data, ensuring coherent control operation across cloud and hybrid dependencies.
• Develop secure connectivity and access patterns for cloud and hybrid environments, collaborating with network security teams on segmentation, firewalling, secure remote access, private connectivity, and DNS.
• Lead technical design decisions, configuration reviews, proof-of-concept activities, testing, troubleshooting, and remediation for assigned cloud security initiatives.
• Review and challenge designs proposed by Microsoft, cloud providers, and delivery partners, ensuring technical proposals meet KAUST security, architecture, resilience, logging, and operational standards.
• Lead or support migration and modernization activities from legacy security platforms to cloud-native capabilities, addressing sequencing, coexistence, rollback, and operational continuity.
• Manage technical dependencies with Enterprise IAM, Saviynt IGA, Network Security and Segmentation, Cyber Exposure Reduction, Security Operations, endpoint management, infrastructure, and application teams.
• Contribute technical leadership to the Microsoft 365 A5 project, including architecture, security configuration, Defender, Entra, Intune, Purview, Security Operations integration, Copilot security controls, testing, pilot readiness, and technical handover.
• Define technical acceptance criteria, validation evidence, security baselines, implementation standards, and production-readiness requirements for assigned initiatives.
• Proactively identify architecture risks, misconfigurations, security gaps, implementation blockers, and vendor dependencies, driving them to resolution with clear ownership and escalation.
• Produce high-quality as-built designs, configuration standards, engineering documentation, runbooks, operational procedures, and knowledge-transfer materials.
• Upskill internal technical teams through pairing, technical walkthroughs, design reviews, troubleshooting, and structured knowledge transfer to ensure sustainable operation of implemented capabilities.

Required Experience

• Candidates should possess 5-10 years of relevant experience in cloud security engineering.

Work Type and Location

This is a full-time position located in Thuwal, Makkah, Saudi Arabia.