Security Engineer III

Veeam is the Data and AI Trust Company, specializing in helping organizations ensure their data and AI are fully understood, secured, and resilient to enable the acceleration of safe AI at scale. As the market leader in both data resilience and data security posture management, Veeam is built for the convergence of identity, data, security, and AI risk. Headquartered in Seattle with offices in more than 30 countries, Veeam protects over 550,000 customers worldwide, who trust Veeam to keep their businesses running. Join us as we go fearlessly forward together, growing, learning, and making a real impact for some of the world’s biggest brands.

About the Role

We're looking for a Security Engineer III to own how we detect and respond to threats across our cloud estate, and to build the security data lake that makes that possible. Our cloud-native SaaS platform runs on Microsoft Azure and AWS, delivering high-trust, secure data protection services to customers across regulated industries. This role sits in Platform Security and owns the detection engineering and cloud security surface end to end: the pipelines that get security telemetry into one queryable place, the detections that fire off it, and the guardrails in Azure and AWS that stop the finding from recurring. You'll partner closely with SRE, Product Engineering, and the rest of Security Engineering, and your work is based on shipped mechanisms rather than on advice given.

What You’ll Do

Design and build our security data lake: decide what telemetry we ingest from Azure, AWS, SaaS, and endpoint sources, how it's normalized and retained, and what it costs, so that detection engineers and incident responders can answer questions in minutes instead of days

Write, tune, and version-control detections as code. Own the full lifecycle: hypothesis, query, test, deploy through CI/CD, measure false-positive rate, and retire what stops earning its keep

Build the response side with the detections. Automate triage and enrichment, wire runbooks into the tooling, and cut mean-time-to-detect and mean-time-to-respond on the alert classes that matter most

Hands on hardening our Azure and AWS environments: identity and RBAC boundaries, network egress, key and secret handling, logging coverage, and public-exposure control across multiple tenants and accounts

Deliver cloud security controls as Terraform. Anything you fix once should land in the modules and pipelines so it stays fixed, in every environment, without a human remembering

Turn cloud security posture findings into a prioritized, owned, and closing queue. Partner with the teams that own the resources and make remediation the path of least resistance

Run detection coverage assessments against a recognized threat framework, find the gaps that matter for our platform and threat model, and close them

Set direction on detection and cloud security tooling: what to adopt, what to retire, and what we build ourselves

Technologies You’ll Work With

Microsoft Sentinel, Log Analytics, and KQL for detection authoring and hunting

Azure security services: Defender for Cloud, Entra ID, Key Vault, Azure Policy, Azure Monitor, Event Hubs

AWS security services: CloudTrail, GuardDuty, Security Hub, IAM, Config, CloudWatch

Terraform for all cloud security and detection infrastructure, with GitHub Actions and Azure DevOps as the delivery path

Wiz for cloud security posture, attack-path analysis, and vulnerability signal

Security data lake and pipeline components: object storage (ADLS / S3), OCSF-style normalization, Azure Data Explorer or an equivalent query engine, and Azure Functions / Lambda for glue

Python for detection tooling, enrichment, and automation, with comfort reading PowerShell and Bash

Sigma and detection-as-code patterns, plus Git-based review for every rule change

What You’ll Bring

5+ years in security engineering, cloud operations, or detection engineering, with recent hands-on ownership of produ