Microsoft Cloud and AI Security Engineer

Standing administrator rights are a standing risk. You use Privileged Identity Management for just-in-time access, remove stored credentials with managed identities, and review who holds what.

• Azure RBAC roles and scopes
• PIM eligible assignments and approvals
• Access reviews
• System-assigned and user-assigned managed identities
• Replacing service principal secrets
• Detecting excessive permissions

You build A privileged access model with eligible roles, approvals and a review schedule.

Secrets leak where they are copied. You design Key Vault access, protect and rotate keys and secrets, and make applications read them at runtime rather than carry them.

• Key Vault access models: RBAC and access policies
• Keys, secrets and certificates
• Soft delete and purge protection
• Rotation and expiry
• Network restrictions for vaults
• Monitoring vault access

You build A hardened Key Vault with rotation, network limits and access logging.

Security rules only hold if they are enforced everywhere. You write and assign Azure Policy to block or remediate risky settings, design custom roles, and track compliance across subscriptions.

• Policy definitions, initiatives and assignments
• Deny, audit and deployIfNotExists effects
• Remediating non-compliant resources
• Custom RBAC roles
• Management groups and inheritance
• Locks and compliance reporting

You build A policy initiative that denies insecure configurations and remediates existing ones.

Storage often holds the data that matters most. You lock down accounts with network rules and identity-based access, limit shared access signatures, encrypt data, and watch for unusual access.

• Disabling public access and shared keys
• Network rules and service endpoints
• Entra-based access and SAS design
• Encryption and customer-managed keys
• Immutability and soft delete
• Defender for Storage and access logging

You build A storage account with no public access, identity-based authorization and logging.

Databases concentrate valuable data behind a few credentials. You enforce Entra authentication, limit network exposure, encrypt and mask data, and turn on auditing and threat detection.

• Entra authentication and removing SQL logins
• Firewall rules and private access
• Transparent data encryption and Always Encrypted
• Dynamic data masking and row-level security
• Auditing and threat detection
• Vulnerability assessment

You build A hardened Azure SQL database with Entra-only authentication, auditing and masking.

Network rules decide what can talk to what. You segment with network security groups and application security groups, filter and inspect with Azure Firewall, and log the traffic that flows.

• NSG rules, priorities and application security groups
• Designing segmentation for a workload
• Azure Firewall rules and policy
• Web application firewall basics
• DDoS protection options
• Flow logs and traffic analytics

You build A segmented virtual network with firewall policy and flow logging.

Platform services should not face the internet. You expose them through private endpoints and Private Link, fix the DNS that breaks without care, and close the public paths.

• Private endpoints and how traffic reaches them
• Private DNS zones and name resolution
• Service endpoints compared with private endpoints
• Disabling public network access
• Private Link for your own services
• Troubleshooting private connectivity

You build Three platform services reachable only through private endpoints, with DNS verified.

Servers are still where many intrusions land. You harden machines, patch them, protect them with Defender for Servers, and control how administrators connect.

• Secure baselines and hardening
• Update management and patching
• Defender for Servers capabilities
• Just-in-time and Bastion access
• Disk encryption and trusted launch
• Endpoint detection on servers

You build A virtual machine baseline with patching, protection and no exposed management ports.

Containers and platform services move fast and expose new surfaces. You secure images and registries, Kubernetes and container hosts, App Service and Functions, and the identities they run as.

• Image security and registry scanning
• AKS security: identity, network policy and admission control
• Container Apps and App Service hardening
• Securing Azure Functions
• Defender for Containers and App Service
• Secrets and identity for platform workloads

You build A hardened container deployment on AKS and a secured Functions app.

AI systems act with real access, which makes identity and gateways the main controls. You give agents their own identities with Entra Agent ID, route model traffic through an AI gateway, and protect Copilot Studio agents.

• Threats to AI applications and agents
• Entra Agent ID and the agent identity lifecycle
• An AI gateway for authentication, limits and logging
• Protecting Copilot Studio agents
• Content safety and prompt attack protection
• Securing model endpoints and grounding data

You build An AI application that calls models through a gateway, with agents holding their own identities.

Posture shows where an estate is weak before an attacker does. You use Defender for Cloud to assess configurations, act on recommendations, and read attack paths, then assign remediation to owners.

• Secure score and recommendations
• Regulatory compliance standards
• Attack path analysis
• Enabling Defender plans by workload
• Governance rules and remediation ownership
• Multicloud connectors

You build A posture review with a prioritized remediation list and assigned owners.

Collecting activity is how threats are found. You connect sources to Microsoft Sentinel, write analytics rules and automation, and set up Security Copilot to help investigate while you check what it tells you.

• Workspaces and data connectors
• Analytics rules and incidents
• Automation rules and playbooks
• Hunting queries in KQL
• Setting up Security Copilot and its access
• Verifying Copilot output against evidence

You build A Sentinel workspace with connected sources, a custom rule and an automated response.

Take one workload from open to defended. You secure identity, data, network, compute and AI components, put posture and detection in place, then test the result against attack scenarios.

• Reviewing a workload’s risks
• Securing identity, data and network layers
• Securing compute and AI components
• Adding posture and detection
• Testing the controls and fixing gaps

You build A secured reference workload with its configuration, detections and a test report.