Cloud Security Senior Associate

About the role

PwC's Cloud and Infrastructure Security team helps organizations design and operate secure cloud environments. As a Senior Associate in its Advisory line of service, you will own cloud security workstreams, assess existing environments, design security controls and help clients improve their posture across cloud platforms and cloud-native technologies.

Key responsibilities

• Design cloud security architectures and secure landing zones across Azure, AWS and multi-cloud estates, integrating identity, network, data protection, logging and CNAPP/CSPM/CWPP controls.
• Engineer Microsoft Defender XDR and Sentinel detections, automation rules, SOAR playbooks and data-ingestion architecture.
• Implement Microsoft Purview DLP, DSPM, Information Protection and insider-risk capability, including labelling taxonomies and rollout planning.
• Lead Kubernetes and container security hardening, including admission control, image scanning, runtime protection and network policy.
• Run risk-based vulnerability management across cloud and on-premises infrastructure, with SLAs, exception handling and executive reporting.
• Assess and harden hybrid infrastructure, including OS baselines, network segmentation, firewall/WAF configuration and EDR coverage.
• Design identity-centric controls such as Entra ID Conditional Access, PIM, workload identities and least-privilege entitlements.
• Lead client workshops, architecture reviews and posture-improvement roadmaps mapped to CIS, NIST CSF and cloud benchmarks.
• Own technical workstreams, quality-assure deliverables and coach graduates and analysts.

Required profile

• Typically 3-6 years of experience in cloud security, infrastructure security, security engineering or related fields.
• Able to lead client-facing technical discussions and turn posture findings into prioritized, costed remediation plans.
• Preferred certifications: SC-500, SC-200, AWS Certified Security Specialty, CCSK or CCSP, CKS; CCNP Security or CySA+ for infrastructure.

Required skills

• Azure and AWS security architecture, network security, encryption and secure landing-zone design.
• CSPM, CWPP and CNAPP platforms such as Microsoft Defender for Cloud, Wiz and Prisma Cloud.
• Microsoft Defender XDR, Sentinel, Intune and Entra ID, including KQL and automation.
• Microsoft Purview, Cyera and Varonis for DSPM, DLP and information protection.
• Kubernetes and container security (AKS/EKS hardening, image supply chain).
• Vulnerability management, network security, firewalls and OS hardening.
• IaC automation with Terraform, Bicep, PowerShell and Python.