Cloud Security Architect / Azure & M365 / IAM & Zero Trust

• 35% Azure cloud security architecture design and implementation
• 25% IAM and PAM configuration, MFA management, and access policy controls
• 25% SOC1 audit readiness, controls documentation, and compliance oversight
• 15% Cross-functional collaboration, documentation, and stakeholder communication

Daily Responsibilities

• 65% Hands On: Configuring and implementing Azure security controls, IAM and PAM policies, access frameworks, and security architecture across the full cloud environment
• 15% Management Duties: Overseeing remediation and mitigation execution by the broader team on audit findings and identified gaps
• 20% Team Collaboration: Working across cloud architects, systems administrators, and project managers on security alignment and implementation priorities

• 7+ years of cloud security experience, with Azure as the primary environment (Azure is a hard requirement)
• Hands-on proficiency with Azure native security tooling: Microsoft Defender for Cloud, Microsoft Sentinel, Entra ID, Conditional Access policies, Azure Policy, Azure Key Vault, and Microsoft Purview
• Demonstrated ability to own cloud security architecture end to end, from design through hands-on configuration and implementation
• IAM and PAM design and implementation: MFA configuration, privileged access management, RBAC, and security baseline setup across the environment
• SOC1 audit experience in a regulated environment, including controls mapping, core findings identification, and remediation oversight
• Zero trust architecture design and implementation in Azure cloud environments
• Clear communication skills across technical and non-technical stakeholders

Desired Skills & Experience

• Certifications: AZ-500 (Microsoft Azure Security Technologies), CISSP, or CCSP
• Background in financial services, fintech, or another highly regulated industry vertical
• Experience building or maturing a cloud security program from scratch with full ownership
• Familiarity with PAM platforms such as CyberArk or BeyondTrust