Join EY and embark on a career path as unique as you are. Leverage global scale, support, and an inclusive culture to achieve your full potential. Your distinct perspective is vital in helping EY achieve even greater heights. Contribute to building an exceptional experience for yourself and a better working world for everyone.

This role focuses on Cloud Security Management, specifically within CMS and cloud environments.

Conduct comprehensive investigations for Defender for Cloud alerts, defining the scope of affected resources, identifying probable attack vectors, and proposing containment strategies. Correlate workload detections with posture context to pinpoint systemic misconfigurations contributing to risk. Troubleshoot and document resolutions for AWS connector data gaps, including permissions, connector health, and plan prerequisites. Understand the AWS connector authentication model, utilizing federated trust and short-lived credentials for secure onboarding and triage. Drive remediation efforts with client teams, validating fixes, confirming risk reduction, managing time-bound exceptions, and refining operational noise.

Identify recurring issues and suggest enhancements for new detections, playbooks, improved routing, and better data enrichment.

Demonstrate strong operational proficiency in both Azure and AWS. This includes deep understanding of Azure's RBAC, networking, and core services like VMs, AKS, storage, and databases. For AWS, expertise in IAM, basic EC2/EKS, security logging concepts, and familiarity with CloudFormation for onboarding patterns is essential.

Possess the ability to explain and utilize posture management concepts, including secure score, recommendations, compliance posture, and remediation workflows. Exhibit strong incident handling discipline, providing containment/eradication guidance, managing stakeholder communications, and producing thorough post-incident documentation. Practical experience with Cloud Security Posture Management (CSPM) tools such as Defender, Wiz, or AWS Security Hub is required.