Senior Network Security Engineer

Senior Cloud Network Security Engineer

Microsoft Specialized Clouds (MSC) is seeking a Senior Cloud Network Security Engineer to design, deploy, and operate network security monitoring capabilities supporting sovereign and government cloud environments. This role focuses on network security telemetry, threat detection, alerting, automation, and operational ownership of critical security services.

The Engineer will be responsible for deploying and configuring network security platforms, building telemetry pipelines, developing detections and alerts, and enabling visibility into network activity across cloud and hybrid environments. The role requires strong network security expertise, experience analyzing packet captures and network telemetry, and the ability to leverage automation and AI to improve monitoring, incident response, and operational efficiency.

As the Directly Responsible Individual (DRI) for assigned services, this engineer will provide operational ownership, incident leadership, and participation in on-call rotations to ensure service reliability, security visibility, and compliance readiness across Microsoft sovereign cloud offerings.

Responsibilities include:

• Design, deploy, and manage network security platforms including firewalls, proxies, and traffic inspection solutions supporting sovereign cloud environments.
• Configure network security devices to export logs, flow records, packet telemetry, and security events to centralized monitoring, analytics, and incident response platforms.
• Develop and maintain network security detections, alerts, and analytics to identify malicious activity, unauthorized access, policy violations, and emerging threats.
• Analyze packet captures, firewall logs, flow data, and network telemetry to support threat investigations, incident response, root cause analysis, and service improvements.
• Build and maintain security telemetry pipelines that provide actionable visibility across network infrastructure, cloud services, and security platforms.
• Develop automation solutions using scripting, Infrastructure as Code, and AI-enabled capabilities to improve detection engineering, alert correlation, incident triage, and operational efficiency.
• Integrate network security telemetry, observability, and incident management platforms to improve monitoring coverage and response effectiveness.
• Create operational dashboards, reporting, and health metrics to measure detection coverage, alert quality, service reliability, compliance posture, and operational risk.
• Partner with engineering, security, and operations teams to define secure network architectures, monitoring standards, deployment patterns, and onboarding requirements for new services.

Other requirements include:

• Embody our company Culture & Values

Qualifications:

• Doctorate in Statistics, Mathematics, Computer Science, or related field OR Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in software development lifecycle, large-scale computing, modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology OR Bachelor's Degree in Statistics, Mathematics, Computer Science, or related field AND 4+ years experience in software development lifecycle, large-scale computing, modeling, cyber security, anomaly detection, Security Operations Center (SOC) detection, threat analytics, security incident and event management (SIEM), information technology OR equivalent experience.

• Microsoft Cloud Background Check: This position will be required to pass the Microsoft Cloud background check upon hire/transfer and every two years thereafter.
• Citizenship & Citizenship Verification: This position requires verification of U.S. citizenship due to citizenship-based legal restrictions. Specifically, this position supports United States federal, state, and/or local government agency customers and is subject to certain citizenship-based restrictions where required or permitted by applicable law. To meet this legal requirement, and as a condition of employment, the successful candidate's citizenship will be verified via a valid passport.

• 2+ years of experience using AI technologies to improve security operations, detection engineering, alert correlation, incident investigation, and operational workflows.
• 2+ years of experience supporting government, regulated, or sovereign cloud environments.
• 10+ years of experience designing, deploying, or operating network security infrastructure and services.
• 5+ years of experience with firewalls, DDoS protection, IDS/IPS platforms, proxies, traffic inspection, and network security controls.
• 5+ years of experience automating operational processes using Python, Terraform, Ansible, Bicep, ARM, or similar technologies.
• 3+ years of experience configuring security devices to export telemetry, logs, events, and flow data for centralized monitoring and threat analysis.
• 3+ years of experience developing security detections, alerting strategies, monitoring content, and operational response processes.
• 5+ years of experience supporting production services, incident response, operational ownership, and on-call rotations.

Security Operations Engineering IC4 - The typical base pay range for this role across the U.S. is USD $119,800 - $234,700 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $160,200 - $261,000 per year.

Certain roles may be eligible for benefits and other compensation. Find additional benefits and pay information here.