Senior - Cloud Access Security

CMS- Cloud Access Security Broker- Senior Responsibilities

• Triage SaaS alerts in Microsoft Defender portal incident/alert queues and attach context (user, app, IP, activity type).
• Monitor Cloud Discovery findings and flag newly discovered high-risk / unsanctioned apps (Shadow IT) for review.
• Maintain ticket updates, evidence capture, and shift handoffs; follow runbooks for SaaS incidents.
• Lead investigations for suspicious SaaS activity, risky OAuth apps, and anomalous data access.
• Pivot across Cloud Apps entities/activities to scope impact, identify root cause, and recommend containment actions (session revocation guidance, app governance steps, permission review, etc.).
• Tune policies (reduce false positives), define sanctioned vs unsanctioned workflows, and produce monthly SaaS risk reports.

Required

• Familiarity triaging security alerts in the Defender portal and working in ITSM systems.
• Strong SaaS security concepts: risky user behavior, data exfil indicators, and admin activity red flags.
• Demonstrated understanding of how Cloud Apps connects to SaaS (API-based visibility and controls).
• Strong incident investigation skills in Defender portal workflows for Cloud Apps.
• Demonstrated knowledge of SaaS identity risk patterns and OAuth permission abuse.
• Working understanding of API connector behavior and constraints.

Preferred Requirements

• Minimum 3+ years of Cloud technology, specifically in CASB or Security engineering roles
• Awareness of Cloud Discovery log-based / API-based ingestion concepts (syslog/FTP pipelines) at a high level.
• Analyst who can combine CASB and web security operations into one role while maintaining strong SaaS risk visibility and policy tuning discipline.