Cloud Security Senior Associate (German Speaker)

About the role

PwC's Advisory line of service has a Cloud and Infrastructure Security team that helps organisations design and operate secure cloud environments. As a Senior Associate in this team, you will take ownership of cloud security workstreams, assess existing environments, design security controls and help clients improve their posture across cloud platforms and cloud-native technologies. The role is open to German speakers.

Key responsibilities

• Design cloud security architectures and secure landing zones across Azure, AWS and multi-cloud estates, integrating identity, network, data protection, logging and CNAPP/CSPM/CWPP controls.
• Engineer Microsoft Defender XDR and Sentinel detections, automation rules, SOAR playbooks and data-ingestion architecture.
• Implement enterprise Microsoft Purview DLP, DSPM, Information Protection and insider-risk capability, including labelling taxonomies and rollout planning.
• Lead Kubernetes and container security hardening, including admission control, image scanning, runtime protection and network policy.
• Run risk-based vulnerability management across cloud and on-premises infrastructure, with SLAs, exception handling and executive reporting.
• Assess and harden hybrid infrastructure, including OS baselines, network segmentation, firewall/WAF configuration and EDR coverage.
• Design identity-centric controls such as Entra ID Conditional Access, PIM, workload identities and least-privilege entitlements.
• Lead client workshops, architecture reviews and posture-improvement roadmaps mapped to CIS, NIST CSF and cloud benchmarks.
• Own technical workstreams, quality-assure deliverables and coach graduates and analysts.

Required profile

• Typically 3-6 years of relevant experience in cloud security, infrastructure security, security engineering or related fields.
• Ability to lead client-facing technical discussions and turn posture findings into prioritised, costed remediation plans.
• Preferred certifications: SC-500, SC-200, AWS Certified Security Specialty, CCSK or CCSP, CKS; CCNP Security or CySA+ for infrastructure.

Required skills

• Azure and AWS security, network security, encryption and secure landing-zone design.
• CSPM, CWPP and CNAPP platforms such as Microsoft Defender for Cloud, Wiz and Prisma Cloud.
• Microsoft Defender XDR, Sentinel, Intune and Entra ID, including KQL and automation.
• Microsoft Purview, Cyera and Varonis for DSPM, DLP and information protection.
• Kubernetes and container security (AKS/EKS hardening, image supply chain).
• Vulnerability management, infrastructure hardening and automation/IaC (Terraform, Bicep, PowerShell, Python).