> Markdown version of [/jobs/ext/3758739-senior-cloud-systems-engineer](https://www.wearedevelopers.com/jobs/ext/3758739-senior-cloud-systems-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Cloud Systems Engineer - **Company:** Morrison & Foerster - **Location:** San Francisco, CA, United States - **Experience:** Expert - **Salary:** $140,000.0 - $185,000.0 - **Contract:** Permanent contract - **Skills:** Microsoft Access, Microsoft Windows, Active Directory, Application Programming Interfaces (APIs), Artificial Intelligence, Application Firewall, Application Integration Architecture, Application Packaging, Audit Trail, User Authentication, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cyber Security, Information Systems, Data Migration, Disaster Recovery, Domain Name System (DNS), Github, Identity and Access Management, Virtual Private Networks (VPN), Python (Programming Language), Kerberos (Protocol), Knowledge Management, Network Security, Log Analysis, SQL Azure, Virtual Desktops, OAuth, Public Key Infrastructure, Windows PowerShell, Role-Based Access Control, Openid Connect, Azure Active Directory, Anti-Phishing, Kusto Query Language, Security Assertion Markup Language (SAML), Single Sign-On, TCP/IP, Virtual Machines, Scripting, Transport Layer Security, Cloud Platform System, Cloud Monitoring, Office365, Azure Powershell, Git, Microsoft InTune, AI Platforms, Information Technology, Deployment Automation, Bicep, Cloud Migration, CIS Benchmarks, Restful APIs, Terraform, Software Version Control, Azure Resource Manager, Key Vault - **Published:** October 15, 2026 - **Apply:** https://www.disabledperson.com/jobs/76060749-senior-cloud-systems-engineer ## About the Role * Bachelors Degree in Computer Science, Information Systems, or related field, or equivalent education and work experience. * A minimum of eight years of enterprise systems engineering experience, including at least five years engineering and administering Microsoft Azure and Microsoft Entra ID (formerly Azure Active Directory). * Enterprise experience (2,000+ users in multiple geographic locations) required. Large law firm experience desired. * Demonstrated experience leading large-scale cloud migration, modernization, or identity initiatives. * Microsoft certifications strongly preferred, including Azure Administrator Associate (AZ-104), Azure Solutions Architect Expert (AZ-305), and Identity and Access Administrator Associate (SC-300). Additional certifications such as SC-500 (or legacy AZ-500), AZ-700, AZ-140, or MD-102 a plus. Microsoft Azure and Microsoft Entra Expertise * Expert-level knowledge of Microsoft Azure architecture, governance, networking, and platform services, including landing zones, Azure Policy, RBAC, hub-and-spoke networking, Private Link, and private DNS. * Expert-level knowledge of Microsoft Entra ID, including Conditional Access, passwordless authentication, Privileged Identity Management, ID Protection, identity governance, and B2B collaboration. * Deep understanding of modern authentication and application identity (SAML, OpenID Connect, OAuth 2.0, SCIM, and workload identities) and of hybrid identity with Entra Connect, Active Directory Domain Services, and Kerberos. * Experience with Microsoft Intune, Windows Autopilot, Azure Virtual Desktop, and the Microsoft Defender portfolio. * Advanced PowerShell scripting skills, including direct use of Azure Resource Manager and Microsoft Graph REST APIs; Python and Azure CLI experience a plus. * Experience with infrastructure as code (Bicep, ARM, and/or Terraform), Git source control, and CI/CD pipelines using GitHub Actions or Azure DevOps. * Working knowledge of Azure Monitor, Log Analytics and KQL, Azure Cost Management, and core network technologies, including TCP/IP, DNS, TLS, and PKI., Morrison & Foerster is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, sex, religion, creed, ethnic or national origin, ancestry, age, disability, veteran or military status, marital status, pregnancy, sexual orientation, gender identity, domestic partner status, and other categories protected by applicable laws, or in retaliation for opposition to any practices forbidden under this policy. ## Description The Senior Cloud Systems Engineer is responsible for the architecture, engineering, security, and operation of the Firms Microsoft Azure environment and Microsoft Entra identity platform. This individual will serve as a senior technical authority for Azure landing zones, governance, networking, and resiliency, and for Microsoft Entra ID identity and access management, including Conditional Access, authentication, privileged access, and application integration. They will manage cloud endpoint and virtual desktop services, including Microsoft Intune and Azure Virtual Desktop. They will lead cloud infrastructure projects from conception through Firm-wide deployment, automating build and operations through infrastructure as code and scripting., * Architects and maintains the Firms Microsoft Azure environment, including landing zones, management group hierarchy, and subscription design, in alignment with the Cloud Adoption and Well-Architected Frameworks. * Establishes and enforces cloud governance through Azure Policy, role-based access control (RBAC), and naming and tagging standards; remediates non-compliance across all subscriptions. * Designs, builds, and supports Azure infrastructure and platform services, including virtual machines and scale sets, App Service, Azure SQL, Azure Storage, and Key Vault. * Engineers Azure networking, including hub-and-spoke topology, network security groups, private endpoints, Private DNS, VPN Gateway and ExpressRoute, and Azure Front Door with Web Application Firewall. * Builds and maintains hardened, standardized virtual machine images with Azure VM Image Builder and Azure Compute Gallery; keeps Azure-hosted servers patched through Azure Update Manager. * Designs for resiliency using availability zones, paired regions, Azure Backup, and Azure Site Recovery; performs backup, restore, data migration, and disaster recovery testing. * In partnership with Information Security, implements cloud security controls, including Microsoft Defender for Cloud, managed identities, Key Vault, and least-privilege access, and remediates findings. * Monitors platform health, performance, capacity, and cost using Azure Monitor, Log Analytics, and Azure Cost Management; supports the Firms Cloud FinOps practice through rightsizing, reservations, and cost allocation. * Develops infrastructure as code (Bicep, ARM, and/or Terraform) and PowerShell automation using Azure Resource Manager and Microsoft Graph REST APIs, delivering repeatable, self-service deployment patterns within governance guardrails. Microsoft Entra Identity and Access Management * Serves as senior administrator and subject matter expert for the Firms Microsoft Entra ID tenant, including identity architecture, tenant configuration, and least-privilege delegated administration. * In partnership with Information Security, designs and maintains Conditional Access policies, including authentication strengths, device compliance, and Continuous Access Evaluation; validates changes in report-only mode before enforcement. * Leads the Firms adoption of phishing-resistant and passwordless authentication, including Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, and certificate-based authentication. * Administers Privileged Identity Management (PIM) for just-in-time access to Entra and Azure roles, and maintains emergency access accounts. * Integrates applications with Entra ID using SAML, OpenID Connect, and OAuth 2.0 single sign-on and SCIM provisioning; governs app registrations, API permissions, and consent. * Manages workload identities, including service principals, managed identities, and workload identity federation, and their secret and certificate lifecycles. * Manages hybrid identity, including Microsoft Entra Connect synchronization with Active Directory Domain Services and Microsoft Entra Kerberos, while advancing the Firms transition to cloud-native identity. * Administers identity governance, including access reviews, entitlement management, dynamic groups, and group-based licensing, as well as B2B guest access and cross-tenant access settings. * Investigates risky users and sign-ins with Microsoft Entra ID Protection; troubleshoots complex authentication and Conditional Access issues through sign-in and audit log analysis; automates identity tasks with Microsoft Graph. Endpoint and Virtual Desktop Services * Manages Microsoft Intune for Windows and mobile endpoints, including Windows Autopilot, compliance and configuration policies, security baselines, application packaging and deployment, and Windows Update for Business and Windows Autopatch. * Engineers and supports Azure Virtual Desktop, including host pools, session host images, scaling plans, and FSLogix profile containers on Azure Files. * Leads the design and support of infrastructure for AI solutions, including Microsoft 365 Copilot and Azure-hosted AI services, in alignment with Firm security and information governance requirements. Operations and Support * Provides Tier III support; accepts, responds to, and resolves escalated incidents on a timely basis, engaging Microsoft and other providers as needed. Monitors team incidents to ensure SLAs and OLAs are met and communicates resolution to users. * Participates in Problem and Knowledge Management initiatives, including root cause analysis of major incidents. * Adheres to departmental policies such as thorough testing and rollback plans and adherence to maintenance windows, and observes Change Management policies and procedures. * Works closely with Information Security, application owners, and office technology staff to maintain production, development, and test environments; provides technical guidance and mentoring to other IT analysts and engineers. * Prepares and maintains technical documentation, including architecture diagrams and runbooks; ensures non-technical decision makers understand technical matters. * Responds to after-hours escalations as needed.