Network/Cloud Infrastructure Security Engineer

CFGis seeking a full-time Network/Cloud Infrastructure Security Engineer to own identity, access, and cloud foundations across Microsoft Entra ID and Azure.

Responsibilities

• Design, build, and maintain secure Azure environments, including landing zones, subscription structure, networking, and resource governance
• Implement and manage infrastructure as code using Terraform and Bicep, plus Azure Policy for consistency, governance, and audit readiness
• Plan and execute tenant, domain, and workload migrations, including Microsoft 365 tenant-to-tenant moves tied to acquisitions and expansion
• Maintain backup and disaster recovery for critical systems, with planning for multi-cloud expansion (for example, AWS)
• Administer and improve Microsoft Entra ID including Conditional Access, MFA, passwordless authentication, and identity protection
• Deliver least-privilege RBAC across Azure and Microsoft 365
• Create and manage Entra ID enterprise applications and app registrations, including SAML/OIDC SSO, SCIM provisioning, API permissions and admin consent, app owners, and certificate/secret expiration controls
• Manage identity and access for GitHub, Linear, and Jira, including Entra ID SSO, SCIM provisioning, permissions, access reviews, and timely offboarding
• Enforce GitHub security best practices: branch protection, required reviews, secret scanning, OIDC federation from GitHub Actions to Azure, and audit log streaming to Microsoft Sentinel
• Serve as primary contact for IAM requests from product development and an escalation point for IT infrastructure and IAM tickets tracked in Zoho ServiceDesk
• Manage guest and external access for client collaboration in Teams and SharePoint, balancing productivity with confidentiality
• Design and improve security controls in Microsoft Defender and Defender for Cloud; remediate posture findings using Microsoft Secure Score and CIS Benchmarks
• Manage Microsoft Sentinel data connectors and detection rules; support incident response for cloud and identity threats with the Director of IT and the firm’s managed 24/7 SOC provider
• Secure email, web, and SaaS access through Exchange Online, Mimecast, and Zscaler policy design
• Create and manage Azure Key Vaults using RBAC-based access, managed identity integration, and rotation/expiration monitoring for secrets, certificates, and keys
• Design and improve SharePoint and OneDrive permissions, Multi-Geo data residency, and Microsoft Purview sensitivity labels, DLP, and retention policies
• Automate administrative and security tasks using PowerShell, Microsoft Graph, Python, and the Azure CLI
• Build workflow automations with Power Automate, Logic Apps, and REST APIs across IT and business platforms
• Ensure AI tools and integrations meet CFGI identity, data, and security standards
• Provide architecture documentation and technical evidence for SOC 2, ISO 27001, and client security reviews
• Support client security questionnaires and due diligence requests covering cloud, identity, and data protection controls
• Evaluate security of new vendors and SaaS applications before connecting them to CFGI identity provider or data
• Maintain architecture diagrams, standards, runbooks, and change records in line with change management practices for owned environments
• Train IT Specialists on identity, Intune, and cloud administration

Requirements

• 5+ years of experience in cloud infrastructure, systems engineering, identity, or security engineering
• Experience administering and engineering Microsoft 365 and Azure environments, including at least 2 years hands-on
• Working knowledge of information security control frameworks
• Experience engineering identity and access controls, including Conditional Access, multifactor authentication, privileged identity management, role-based access, enterprise application integration, and hybrid identity
• Experience administering cloud infrastructure including networking, compute, storage, and resource governance
• Experience administering source-code hosting organizations including SSO, automated provisioning, team-based permissions, branch protection, secret scanning, and secure credential handling for CI/CD workflows
• Proficiency in administrative scripting and API-based automation
• Experience with infrastructure as code and version control
• Experience with Microsoft Entra ID including enterprise applications, app registrations, Active Directory, and Entra Connect / Cloud Sync
• Experience administering GitHub organizations and securing GitHub Actions
• Proficiency with PowerShell and Microsoft Graph
• Experience with Terraform, Bicep, or ARM, and Git
• Working knowledge of frameworks such as CIS, NIST CSF, SOC 2, or ISO 27001
• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or related field, or equivalent professional experience

Location

• Primarily remote, with in-person work when required
• Eastern Time Zone, in the Northeast or Southeast US
• Occasional travel for projects or company events

Nice to Have

• Certifications such as Microsoft SC-300, AZ-104, AZ-500, AZ-305, GitHub Administration, or AWS Solutions Architect – Associate
• Working knowledge of AWS, including IAM, IAM Identity Center federation with Entra ID, AWS Organizations, and security services such as CloudTrail, GuardDuty, and Security Hub
• Experience administering Jira, including Atlassian Guard, or Linear
• Experience in professional services, accounting, or financial services, including supporting client audits and security questionnaires

Technologies

• Microsoft Entra ID, Microsoft 365, Azure, Azure Policy, Microsoft Sentinel, Microsoft Defender, Defender for Cloud, Microsoft Secure Score
• CIS Benchmarks, Zoho ServiceDesk, PowerShell, Microsoft Graph, Python, Azure CLI
• Power Automate, Logic Apps, REST APIs
• Exchange Online, Mimecast, Zscaler
• Azure Key Vault, RBAC, Microsoft Purview, DLP, SharePoint, OneDrive, Intune, Multi-Geo
• GitHub, GitHub Actions, SAML, OIDC, SCIM, MFA, passwordless authentication, Conditional Access, identity protection, least-privilege RBAC, API permissions and admin consent, certificate and secret expiration
• Branch protection, secret scanning, OIDC federation, SOCs (managed 24/7 SOC provider)
• SOC 2, ISO 27001, NIST CSF, CIS, AWS, ARM, Git, Active Directory, Entra Connect, Cloud Sync

AI Tools Notice

• AI tools may support parts of the hiring process such as reviewing applications, analyzing resumes, and assessing responses for potential inconsistencies or verification signals
• AI tools assist the recruitment team but do not replace human judgment
• Final hiring decisions are made by humans
• For more information about how data is processed, contact the recruiter