> Markdown version of [/jobs/ext/539202-security-and-infrastructure-architect](https://www.wearedevelopers.com/jobs/ext/539202-security-and-infrastructure-architect). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security and Infrastructure Architect - **Company:** Tokenworks, Inc. - **Location:** Bronxville, NY, United States (Remote available) - **Experience:** Expert - **Salary:** $110,000.0 - $130,000.0 - **Contract:** Permanent contract - **Skills:** Admin Tools, Artificial Intelligence, Audit Trail, Microsoft Azure, Bash Shell, BitLocker Drive Encryption, Software as a Service, Cloud Computing, Cyber Security, Computer Programming, Github, Intrusion Detection Systems, Python (Programming Language), Key Management, Network Security, Microsoft Security Essentials, Windows PowerShell, Role-Based Access Control, Remote Access Technology, Azure Active Directory, Zero Trust Network Access, Virtual Local Area Networks, Software Vulnerability Management, Zoho Office Suite, Data Logging, Microsoft InTune, Cloudflare, Gsuite, SentinelOne Expertise, Key Vault - **Published:** June 14, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=4650301eb51fbf2b ## About the Role Do you have experience in Remote access software?, * A proven history of designing, implementing, and operating Microsoft-centric security stacks for other companies. * Deep Entra ID expertise - Conditional Access, PIM/JIT, break-glass, admin tiering, eliminating standing Global Admin rights. * Expert-level Intune for endpoint and mobile management. * Strong Azure security: RBAC, Defender for Cloud, Key Vault, Azure Policy, network security. * Hands-on EDR/MDR and incident response - Huntress, SpearTip, SentinelOne, CrowdStrike, or Defender. * Vulnerability management with Defender for Cloud and a scanner like Aikido or Snyk. * Google Workspace administration and federating it with Entra. * Network/firewall hardening and segmentation. * SOC 2 evidence experience; Vanta (or Drata/Secureframe) hands-on strongly preferred. * Solid scripting (PowerShell/Graph, Python, or Bash) and excellent documentation. Programming skills - including the ability to use AI to generate code - are preferred. Nice to have * Experience as the architect or first security hire who built a program from scratch. * Multi-IdP (Entra + Google Workspace) production experience. * Certifications: AZ-500, SC-200, SC-300, MS-102, Security+, CISSP, or GIAC. * Cloudflare Zero Trust device-posture deployment. ## Description We're hiring a Senior Microsoft security expert to design, build, and run our security and identity infrastructure end to end. This is a hands-on architect role for someone who has done exactly this for other companies and can bring proven patterns rather than learn on ours. You'll own everything from Entra and Intune to the office firewall, integrate it all into Vanta for SOC 2, and work shoulder-to-shoulder with our engineers to bake security into the product. We also want our security systems designed to take advantage of AI: while solid security fundamentals come first, we value someone who can creatively apply AI to automate tasks and improve our ability to detect and respond to threats and vulnerabilities. What you'll do * Architect Microsoft Entra ID: Conditional Access, MFA, PIM with just-in-time elevation, break-glass accounts, and an admin model with no standing Global Admins on day-to-day accounts. * Own Microsoft Intune: secure all laptops and mobile devices - compliance, configuration, BitLocker, app protection - and build unified onboarding/offboarding. * Secure Microsoft Azure: RBAC, Defender for Cloud, Key Vault, Azure Policy, and dev/staging/prod separation. * Design the office network: firewall hardening, VLAN segmentation, secure remote access with MFA, IDS/IPS, and centralized logging. * Secure Google Workspace with Entra: federate identity and enforce consistent MFA and posture across both ecosystems. * Run security operations: operate EDR/MDR and identity-threat tooling (Huntress), manage the SpearTip IR retainer, run incidents and tabletops. * Drive vulnerability management: track and remediate findings from Defender for Cloud and Aikido with the engineering team. * Apply AI to security: creatively use AI to automate routine security tasks and sharpen threat and vulnerability detection and response across the stack. * Partner with engineering: secure SDLC, deployment-approval gates, and secrets management so security is designed in. * Secure our SaaS apps: Zoho One, Linear, Claude, GitHub and more - SSO, least privilege, MFA, clean offboarding. * Own SOC 2 / Vanta: integrate access and audit logs from every system into Vanta, keep connectors green, and partner with our external SOC 2 advisor through the audit. ## Related Videos - [Best Practices for Using GitHub Secrets](https://www.wearedevelopers.com/videos/1214-best-practices-for-using-github-secrets) - [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Develop enterprise-ready applications for Microsoft Teams with Azure resources on modern web technologies](https://www.wearedevelopers.com/videos/187-develop-enterprise-ready-applications-for-microsoft-teams-with-azure-resources-on-modern-web-technologies) - [Bringing AI Model Testing and Prompt Management to Your Codebase with GitHub Models](https://www.wearedevelopers.com/videos/1536-bringing-ai-model-testing-and-prompt-management-to-your-codebase-with-github-models) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers) - [The Overflow: 5 Security and Privacy Tools for Developers](https://www.wearedevelopers.com/magazine/710-the-overflow-5-security-and-privacy-tools-for-developers) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers)