Cloud Security Engineering Lead

About the Role

King Abdullah University of Science & Technology (KAUST) is seeking a Cloud Security Engineering Lead to contribute to its Cybersecurity Transformation Program. This full-time role focuses on designing, implementing, and assuring secure cloud and hybrid environments across KAUST's multi-cloud infrastructure. The position combines solution architecture with direct technical execution across various security domains, including cloud security, identity, endpoint, security operations, Zero Trust, and modern workplace security.

Role Context and Program Focus

The Cybersecurity Transformation Program at KAUST emphasizes modern security architectures, Zero Trust principles, and sustainable operational handover. The Cloud Security Engineering Lead will translate security requirements into deployable technical controls, lead complex implementation activities, and resolve cross-platform dependencies. Key initiatives within the portfolio include Microsoft 365 A5, Enterprise IAM, cloud security posture improvement, security operations integration, network security and segmentation, and cyber exposure reduction. The role requires a hands-on approach to design, configuration, integration, troubleshooting, testing, remediation, and knowledge transfer, while providing technical direction to partners and internal teams.

Key Responsibilities

• Own cloud security architecture and engineering activities across assigned initiatives within the Cybersecurity Transformation Program, from design through operational handover.
• Assess Azure, Microsoft 365, hybrid, and multi-cloud environments to identify security gaps and opportunities for control improvement.
• Design and implement secure cloud architectures aligned with KAUST security principles, enterprise architecture standards, and Zero Trust objectives.
• Provide hands-on engineering across Microsoft Entra ID, Conditional Access, Privileged Identity Management, Identity Protection, MFA, passwordless controls, Intune, Defender XDR, Defender for Cloud, Microsoft Sentinel, and Microsoft Purview.
• Engineer and improve cloud security posture management, workload protection, attack-path reduction, logging, monitoring, and security configuration across IaaS, PaaS, SaaS, endpoint, and identity environments.
• Design and implement integrations between cloud platforms and Security Operations, including SIEM/SOAR telemetry, detection use cases, KQL analytics, and incident automation.
• Apply Zero Trust principles across identity, privileged access, endpoints, applications, network access, collaboration, and data.
• Develop secure connectivity and access patterns for cloud and hybrid environments, collaborating with network security teams.
• Lead technical design decisions, configuration reviews, proof-of-concept activities, testing, troubleshooting, and remediation for assigned initiatives.
• Review and challenge designs proposed by Microsoft, cloud providers, and delivery partners to ensure adherence to KAUST standards.
• Lead or support migration and modernization activities from legacy security platforms to cloud-native capabilities.
• Manage technical dependencies with various internal teams including Enterprise IAM, Network Security, and Security Operations.
• Contribute technical leadership to the Microsoft 365 A5 project, covering architecture, security configuration, and operational integration.
• Define technical acceptance criteria, validation evidence, security baselines, and production-readiness requirements.
• Identify and resolve architecture risks, misconfigurations, security gaps, and implementation blockers.
• Produce high-quality as-built designs, configuration standards, engineering documentation, and knowledge-transfer materials.
• Upskill internal technical teams through pairing, technical walkthroughs, and structured knowledge transfer.

Required Skills and Experience

• Deep hands-on cloud security engineering expertise across Microsoft Azure and Microsoft 365, encompassing architecture, configuration, integration, troubleshooting, and operationalization.
• Strong knowledge of Microsoft security technologies including Entra ID, Conditional Access, PIM, Identity Protection, Defender XDR, Defender for Cloud, Intune, Microsoft Sentinel, and Microsoft Purview.
• Strong understanding of cloud security architecture across identity, network, endpoint, workloads, applications, data, logging, monitoring, and security operations.
• Practical experience designing and implementing Zero Trust architectures and identity-centric security controls in enterprise environments.
• Strong understanding of SIEM/SOAR, detection engineering, KQL or comparable query languages, security telemetry onboarding, incident automation, and SOC integration.
• Experience with cloud security posture management, workload hardening, attack-path analysis, secure configuration baselines, and remediation across IaaS, PaaS, and SaaS.
• Ability to design secure hybrid and multi-cloud integrations, including federation, SSO, network connectivity, logging, and security control alignment.
• Strong technical governance and engineering judgment, including the ability to challenge vendor designs and translate security requirements into practical implementation decisions.
• Ability to lead multidisciplinary technical teams and delivery partners while maintaining hands-on engagement in critical technical work.
• Strong written and verbal communication skills, including the ability to explain technical risks, architecture decisions, and delivery implications to both technical and senior stakeholders.
• An evidence-led and outcome-oriented approach.