About Sand
Sand Technologies is a global Physical AI company using data and AI to make critical industries work better. We partner with governments, cities and enterprises to improve how essential systems operate across healthcare, water, energy, telecommunications and infrastructure.
Our work delivers proven real-world impact. We have built AI systems that help manage London’s water supply, supported telecom network planning across hundreds of cities, and developed digital healthcare platforms serving tens of millions of people across Africa. From intelligent command centers to AI-powered infrastructure platforms, we help organizations sense, analyze and act in complex environments.
Our people are ambitious, curious and relentlessly practical. Our teams work alongside clients in the field, solving hard problems and deploying solutions that last. With colleagues across Africa, Europe, the UK and the US, we operate across the full stack - from research and engineering to deployment and capability building.
Our mission is simple: to harness AI to solve humanity’s most pressing challenges.
About the role
Sand Technologies is standing up its security engineering capability, and you'll be engineer #1, working directly with the Director of Cyber Security. We are looking for a candidate with subject matter expertise in implementation and management of cloud security across AWS, Azure, and GCP.
This is a hands-on role, with an opportunity to have a deep impact on audits, executive metrics, and the security of a live AI product. Most junior security roles are ticket queues. This one is a program build: you'll touch three clouds, a modern Microsoft security stack, audit evidence for four frameworks, and the security posture of a shipping AI product — with direct mentorship from a security director and visible impact into executive reporting from your first quarter.
What you’ll do
- Serve as second responder on security incidents across Sand: fraud, phishing, endpoint, identity, shadow IT, and cloud, running evidence collection, triage, containment coordination, and lessons learned
- Operate and tune our security stack: Microsoft Defender for Cloud/Endpoint, Intune, Sentinel, and vulnerability scanning across a multi-account AWS organization, GCP, and Azure
- Build and maintain the vulnerability data pipeline: raw exports from cloud-native tools, deduplication by unique CVE, finding-age and SLA computation, and the feeds behind our security metrics
- Run tooling validations — side-by-side parity testing when we transition platforms, with evidence that stands up to audit
- Partner with infrastructure/DevOps teams on remediation: container base-image hygiene, registry lifecycle policies, exposure management, and verifying closure on the next scan
- Track remediation SLAs, support exception and risk-acceptance workflows, and keep runbooks and process documentation current
- Build detection in Microsoft Sentinel: onboarding and tuning log sources across email, identity, endpoint, SaaS, and cloud
- Embed security gates in CI/CD pipelines and stand up telemetry for new environments
- Contribute evidence to Cyber Essentials, ISO 27001, SOC 2, and ISO/IEC 42001 readiness workstreams
- In your first 90 days you will:
- Own the weekly vulnerability data pipeline end-to-end (exports → dedup → SLA math → metrics feed)
- Complete one tooling parity validation with documented, audit-ready evidence
- Ship one structural remediation with the infrastructure team (e.g., registry lifecycle policies) and verify closure by scan
- Stand up telemetry on one new cloud environment from zero
- Step into the second-responder seat: run one incident or tabletop end to end, with documented lessons fed back into the runbooks
Who you are
- grounded by at least 5-7 years of professional cloud/DevOps experience and at least 2–4 years in security engineering, cloud/DevOps with a security focus, or security operations
- Working proficiency in at least one major cloud (AWS, Azure, or GCP) and hunger to learn the other two
- Scripting for automation — Python preferred; comfort with REST APIs and structured data (JSON/CSV); KQL or SQL a plus
- Understanding of vulnerability management fundamentals (CVE/CVSS, scanning vs. remediation, SLA-driven programs) and a calm, methodical approach to incident response
- Clear writing and the ability to explain a finding to an engineer and its risk to an executive
- Self-direction — you'll have a director's guidance, not a script
Preferred experience
- Hands-on time with Microsoft Defender / Sentinel, or Qualys
- Terraform or other infrastructure-as-code exposure
- Container security (ECR/AKS image scanning, lifecycle policies)
- Cyber Essentials, ISO 27001, SOC 2, or ISO/IEC 42001 evidence experience
- Relevant certifications: SC-200, AZ-500, Security+ (or equivalent demonstrated skill)
How we work
Due to the highly collaborative and internationally distributed nature of our work, successful candidates must be comfortable operating in small teams while contributing to larger, globally coordinated efforts. A strong sense of ownership, self-motivation and discipline in maintaining clear and consistent communication through virtual collaboration tools and video conferencing is essential.
