Cyber Security Engineer

About the role

Rozmith is a security-first managed IT and cybersecurity partner for insurance, financial services and other regulated firms across the US, UK and Europe, running clients' IT and security day to day and handling the IT side of their mergers and acquisitions. It is hiring a Cyber Security Engineer to build and run the security controls that keep regulated clients protected and audit-ready. The role is based in Skopje with a hybrid model, overlapping US Eastern business hours.

Key responsibilities

• Design, deploy and tune security controls across clients' Microsoft environments: identity, endpoint, email, cloud and network.
• Take escalations from analysts, lead remediation and set the security standards for each client from day one.
• Deploy and tune CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR and Defender for Cloud, and run email security with Abnormal Security and Mimecast.
• Harden Microsoft 365, Entra ID, Intune and Azure against CIS benchmarks and Secure Score.
• Design and enforce Conditional Access, phishing-resistant MFA, PIM and privileged access.
• Build Sentinel analytics rules, workbooks and automated playbooks.
• Lead incident remediation from containment to root cause, and own vulnerability management with Tenable, Axonius and Tanium.
• Run identity governance in Lumos and privileged access with Delinea, and roll out data and AI security controls with Purview, Varonis and Firefly.
• Map controls to CIS, NIST, ISO 27001 and SOC 2, produce audit evidence in Apptega, and coach analysts and review their investigations.

Required profile

• 3-5 years in security engineering, with at least 2 years primarily on Microsoft security.
• Hands-on deployment of an enterprise EDR (CrowdStrike or SentinelOne) alongside Sentinel and Defender XDR.
• Strong Entra ID: Conditional Access, MFA, PIM and identity protection.
• Experience hardening Microsoft 365 and Intune-managed devices.
• Incident response experience from containment to lessons learned, and experience producing control evidence for audits.
• Clear written English, able to explain risk to executives and engineers.

Required skills

• KQL for detections and hunting; PowerShell for automation.
• Working knowledge of firewalls and network security; Fortinet helps.
• Nice to have: MSP or multi-tenant experience with Azure Lighthouse, regulated frameworks such as SOC 2, GDPR, NIS2 or DORA, security integration during M&A, identity governance and PAM tools (Lumos, SailPoint, Delinea), and certifications AZ-500, SC-200, SC-300, CISSP or CCSP.

What we offer

• Hybrid working from the Skopje office and remotely.
• Shared after-hours on-call rotation, company laptop, paid certification prep and exam vouchers.