EYCMS-Manager-Cloud Engineer
About this role
At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all.
CMS- Cloud Security _Manager
Responsibilities:
- Perform end-to-end investigations for Defender for Cloud alerts: scoping affected resources, identifying likely attack vectors, and recommending containment steps.
- Correlate workload detections with posture context to identify systemic misconfigurations driving risk.
- Troubleshoot AWS connector data gaps (permissions, connector health, plan prerequisites) and document resolution steps.
- Understand the AWS connector auth model (federated trust and short-lived credentials) to support secure onboarding and triage.
- Drive remediation execution with client teams: validate fixes, confirm risk reduction, manage exceptions (time-bound), and tune operational noise.
- Identify recurring issues and propose new detections/playbooks, improved routing, and better enrichment.
Required:
Strong Azure and AWS operational fluency:
- Azure: RBAC, networking, key services (VMs, AKS, storage, databases)
- AWS: IAM, EC2/EKS basics, security logging concepts, CloudFormation familiarity (for onboarding patterns)
- Ability to explain and operate posture management: secure score, recommendations, compliance posture, and remediation workflow.
- Incident handling discipline: containment/eradication guidance, stakeholder communications, and post-incident documentation.
- Hands-on experience with CSPM tools (Defender/Wiz/AWS Security Hub etc).
Preferred Requirements:
- Minimum 8+ years of Cloud technology, specifically in Security engineering, or Security Architecture roles
- Experience designing/tuning SOC playbooks for cloud detection and posture workflows.
- Familiarity with automation (Logic Apps/SOAR patterns) and integrating CNAPP events into SIEM/SOAR pipelines.
- SC-200 + AZ-500 (preferred), AWS Security Specialty, GIAC Cloud (GCLD) or similar.
EY | Building a better working world
EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets.
Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate.
Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.
- Start applying with LinkedIn
- Apply Now Start
-
Please wait...
- Connect with us
- Our locations
- My EY
- Site map
- Legal and privacy
- Labor condition applications
- Cookie Consent Manager
-
Opens in a new tab.
-
Opens in a new tab.
-
Opens in a new tab.
-
Opens in a new tab.
-
Opens in a new tab.
EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
×Cookie Consent Manager
When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
Required Cookies
These cookies are required to use this website and can't be turned off.
Required Cookies Show More Details Required Cookies Provider Description Enabled SAP as service provider We use the following session cookies, which are all required to enable the website to function:- "route" is used for session stickiness
- "careerSiteCompanyId" is used to send the request to the correct data center
- "JSESSIONID" is placed on the visitor's device during the session so the server can identify the visitor
- "Load balancer cookie" (actual cookie name may vary) prevents a visitor from bouncing from one instance to another
Advertising Cookies
These cookies serve ads that are relevant to your interests. You may freely choose to accept or decline these cookies at any time. Note that certain functionality that these third parties make available may be impacted if you do not accept these cookies.
Consent to all Advertising Cookies Show More Details