To establish a high‑performance offshore Cloud Security Engineering capability that delivers scalable, cost‑efficient, and standards‑aligned security engineering across Azure, AWS, and GCP environments. This work package defines the roles, responsibilities, deliverables, onboarding process, governance model, and KPIs required to recruit and operate an offshore Cloud Security Engineering team.
Cloud security configuration and hardening (Azure, AWS, GCP)
Identity & access engineering (Entra ID, IAM, SSO, Conditional Access)
Network security engineering (segmentation, firewalls, WAF, private endpoints)
Security tooling integration (SIEM, SOAR, CSPM, CIEM, EDR/XDR)
Secure‑by‑Design implementation for cloud workloads
Infrastructure‑as‑Code security (Terraform, Bicep, CloudFormation)
Cloud logging, monitoring, and detection engineering
Cloud vulnerability remediation scripting
Secrets management engineering (Key Vault, KMS, Secret Manager)
Zero Trust enforcement across cloud platforms
Skills:
Cloud security architecture fundamentals
IAM engineering, MFA, Conditional Access
Network security (NSGs, SGs, WAF, private endpoints)
Encryption, key management, certificate lifecycle
Logging, monitoring, SIEM onboarding
Terraform/Bicep/CloudFormation
DevSecOps pipeline security
Certifications (preferred):
Azure Security Engineer (AZ‑500)
AWS Security Specialty
GCP Professional Cloud Security Engineer
Skills:
Multi‑cloud security design and implementation
Threat modelling for cloud workloads
CSPM/CIEM engineering
Zero Trust enforcement
Leading offshore engineering teams
Reviewing IaC for security defects
Certifications:
Azure Solutions Architect Expert
AWS Solutions Architect Professional
CISSP or CCSP
Skills:
CI/CD pipeline security
SAST/DAST/SCA integration
Container security (Aqua, Prisma, ECR, ACR)
Kubernetes security (AKS, EKS, GKE)
Secrets management automation
Skills:
Python/PowerShell automation
SOAR playbook development
CSPM remediation scripting
API‑based security automation
Job descriptions
Skills matrix
Certification requirements
Experience thresholds
Interview scoring rubrics
Technical cloud security test
IaC security challenge
Hands‑on cloud hardening scenario
Behavioural and communication assessment
Final competency scoring
Shortlisted candidates
Final selection report
Skills gap analysis
Salary benchmarking (offshore region)
Contracting recommendations
Secure‑by‑Design onboarding
Cloud platform access provisioning
Tooling access (SIEM, CSPM, CIEM, DevSecOps)
Engineering standards briefing
Architecture patterns walkthrough
Cloud hardening playbook
Identity engineering playbook
Logging & monitoring onboarding playbook
IaC security review playbook
Zero Trust enforcement playbook
Onshore Security Architect (Accountable)
Offshore Technical Lead (Responsible)
Daily engineering stand‑ups
Weekly progress reporting
Monthly capability maturity review
Agile sprint‑based engineering
Backlog prioritisation with onshore architect
SLA‑based engineering tasks
Change control for cloud security configurations
% of cloud workloads onboarded to security baselines
Time to remediate cloud vulnerabilities
IaC security defect reduction rate
CSPM/CIEM risk reduction
SIEM/SOAR onboarding throughput
Compliance alignment (ISO, NIST, CIS)
Engineering quality score (peer review)
Fully staffed offshore Cloud Security Engineering team
Documented engineering standards and playbooks
Operational governance model
Monthly performance dashboards
Continuous improvement roadmap
FTE‑based offshore team (monthly retainer)
Hybrid onshore/offshore model
Outcome‑based engineering packages
Time‑and‑materials for specialist tasks
This offshore work package provides:
40–60% cost reduction vs onshore engineering
Scalable multi‑cloud security delivery
Faster onboarding of cloud workloads
Standardised engineering quality
Continuous compliance alignment
Zero Trust‑aligned cloud security enforcement