Cloud Engineer

Roles/Responsibilities:

1. Identity Architecture & Foundation

• Design and document scalable Azure Entra ID tenant topologies, including multi-organization frameworks and external B2B/B2C collaboration structures.
• Establish and enforce enterprise-wide identity standards, architecture guardrails, and naming conventions across all business units and branches.
• Architect and manage secure deployment matrices for workload identities, including Service Principals, Managed Identities, and application registrations.

2. Security, Authentication & Zero Trust Implementation

• Configure and deploy a comprehensive Conditional Access policy suite tailored to role-based risks and user sign-in risk levels.
• Implement and scale passwordless authentication mechanisms across the enterprise, including FIDO2 security keys, Passkeys, and Windows Hello for Business.
• Deploy and tune Identity Protection policies to enable automated risk-based authentication and real-time remediation of compromised accounts.
• Establish secure lifecycle management and automated rotation frameworks for cryptographic keys, certificates, and application secrets.

3. Identity Governance & Lifecycle Automation

• Build and automate end-to-end Joiner, Mover, and Leaver (JML) user lifecycle workflows utilizing Microsoft Graph API, PowerShell, and Azure Functions.
• Engineer self-service entitlement management catalogs and automate compliance-driven access reviews using Azure Logic Apps.
• Formulate and enforce lifecycle governance policies for guest access, external partners, and B2B user permissions.

4. Application & API Integration

• Integrate and onboard SaaS, on-premises, and custom-developed applications (.NET/C#) using standard OAuth 2.0, OpenID Connect, and SAML 2.0 protocols.
• Configure custom token issuance, claims mapping, and MSAL-based authentication across single-page apps, web apps, and web APIs.
• Develop and execute custom authentication extensions to dynamically inject external claims or modify default authentication flows.

5. Automation, Scripting & DevOps (CI/CD)

• Integrate identity configurations and policy changes into automated CI/CD pipelines to achieve Identity-as-Code (IaC).
• Write and maintain clean, reusable script libraries using PowerShell, Azure CLI, and Microsoft Graph SDKs to automate repetitive identity workflows.

6. Compliance, Risk Management & Operations

• Align and map Entra ID technical controls to regulatory frameworks, including NIST, FedRAMP, SOC 2, and ISO 27001.
• Compile and deliver structured audit evidence packages to demonstrate the compliance and efficacy of identity controls.
• Author technical runbooks for operational teams to streamline the monitoring, troubleshooting, and optimization of complex token and authentication flows.

7. Cross-Functional Leadership & Enablement

• Translate complex business and compliance requirements into comprehensive Technical Design Documents (TDD).
• Collaborate with security, application, DevOps, and infrastructure teams to drive enterprise-wide identity modernization initiatives.
• Communicate high-level identity strategies and risk profiles effectively to non-technical stakeholders and executive leadership.

Mandatory Skills:

1. Strong experience with Microsoft Entra ID / Azure AD architecture and administration.
2. Proficiency in PowerShell scripting, Microsoft Graph API, and REST APIs.
3. Knowledge of OAuth 2.0, OpenID Connect, SAML, and SCIM protocols.
4. Experience with Conditional Access, MFA, and Identity Governance.
5. Familiarity with Azure AD Connect, Hybrid Identity, and Single Sign-On (SSO).
6. Understanding of Zero Trust principles and modern authentication methods.

Desirable Skills:

1. Microsoft certifications such as SC-300 (Identity and Access Administrator) or AZ-104 (Azure Administrator).
2. Experience with Azure Functions, Logic Apps, or Power Automate for workflow automation.
3. Background in security compliance frameworks (e.g., ISO 27001, NIST).
4. Soft Skills & Leadership:

1. Translate business requirements into secure identity solutions
2. Communicate complex identity concepts to non-technical stakeholders
3. Drive identity modernization initiatives
4. Ability to partner with:

1. Cloud solution architects
2. DBAs
3. DevOps
4. Infrastructure admins

5. Azure AD B2C / External Identities (CIAM)
6. Cross-cloud identity (AWS, Google Cloud Platform federation)
7. Identity-related incident response
8. Strong problem-solving and analytical skills.
9. Excellent communication and collaboration abilities.
10. Ability to work in a fast-paced, dynamic environment.
11. Certifications:
12. Microsoft Identity and Access Administrator
13. Azure Solutions Architect
14. Security-focused certifications