Network/Cloud Infrastructure Security Engineer

CFG I is hiring a Network/Cloud Infrastructure Security Engineer to help build and secure cloud and identity foundations across Microsoft Entra ID and Azure, with direct ownership of IAM and cloud security controls. This hybrid role (United States) is focused on practical engineering work that supports governance, compliance readiness, and escalation for infrastructure and identity requests across IT.

In this position, you will design secure Azure environments, standardize deployments using infrastructure as code and policy, and improve how CFGI protects access to internal and external applications. You will also lead the technical evidence, documentation, and incident support needed for ongoing client and audit requirements, in coordination with the firm’s managed 24/7 SOC provider.

Responsibilities

• Design, build, and maintain secure Azure environments, including landing zones, subscription structure, networking, and resource governance.
• Implement and manage infrastructure as code with Terraform and Bicep, and use Azure Policy for consistent, governed, and auditable cloud configuration.
• Plan and execute tenant, domain, and workload migrations, including Microsoft 365 tenant-to-tenant moves for acquisitions and expansion.
• Maintain backup and disaster recovery for critical systems, and support future multi-cloud expansion (including AWS).
• Administer and improve Microsoft Entra ID, including Conditional Access, MFA and passwordless authentication, identity protection, and least-privilege RBAC across Azure and Microsoft 365.
• Create and manage Entra enterprise applications and app registrations for SAML/OIDC SSO, SCIM provisioning, API permissions and admin consent, app owners, and certificate/secret expiration.
• Manage identity and access for GitHub, Linear, and Jira, including Entra ID SSO, SCIM provisioning, team and project permissions, access reviews, and timely offboarding.
• Enforce GitHub security practices such as branch protection, required reviews, secret scanning, OIDC federation from GitHub Actions to Azure, and audit log streaming to Microsoft Sentinel.
• Act as a primary contact for IAM requests from product development and an escalation point for infrastructure and IAM tickets tracked in Zoho ServiceDesk.
• Manage guest and external access for client collaboration in Teams and SharePoint while balancing productivity and confidentiality.
• Design and improve security controls across Microsoft Defender and Defender for Cloud, remediating posture findings using Microsoft Secure Score and CIS Benchmarks.
• Manage Microsoft Sentinel data connectors and detection rules, and lead incident response for cloud and identity threats alongside the Director of IT and the managed 24/7 SOC.
• Secure email, web, and SaaS access through Exchange Online, Mimecast, and Zscaler policy design.
• Create and manage Azure Key Vaults with RBAC-based access, managed identity integration, and secret/certificate/key rotation and expiration monitoring.
• Design SharePoint and OneDrive permissions, support Multi-Geo data residency, and configure Microsoft Purview sensitivity labels, DLP, and retention policies.
• Automate administrative and security tasks using PowerShell, Microsoft Graph, Python, and the Azure CLI; build workflow automations with Power Automate, Logic Apps, and REST APIs.
• Ensure AI tool usage and integrations meet CFGI identity, data, and security standards.
• Provide architecture documentation and technical evidence for SOC 2, ISO 27001, and client-driven security reviews, including support for client security questionnaires and due diligence.
• Evaluate the security of new vendors and SaaS applications before integration with CFGI identity provider or data.
• Maintain architecture diagrams, standards, runbooks, and change records aligned with change management for environments this role owns.
• Train IT Specialists on identity, Intune, and cloud administration.

Requirements

• 5+ years of experience in cloud infrastructure, systems engineering, identity, or security engineering.
• Experience administering and engineering Microsoft 365 and Azure environments, including at least 2 years of hands-on experience.
• Working knowledge of information security control frameworks.
• Experience engineering identity and access controls, including Conditional Access, multifactor authentication, privileged identity management, role-based access, enterprise application integration, and hybrid identity.
• Experience administering cloud infrastructure including networking, compute, storage, and resource governance.
• Experience administering source-code hosting organizations, including SSO, automated provisioning, team-based permissions, branch protection, secret scanning, and secure credential handling for CI/CD workflows.
• Proficiency in administrative scripting and API-based automation.
• Experience with infrastructure as code and version control.
• Experience with Microsoft Entra ID, including enterprise applications, app registrations, Active Directory, and Entra Connect / Cloud Sync.
• Experience administering GitHub organizations and securing GitHub Actions.
• Proficiency with PowerShell and Microsoft Graph.
• Experience with Terraform, Bicep, or ARM, and Git.
• Working knowledge of frameworks such as CIS, NIST CSF, SOC 2, or ISO 27001.
• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent professional experience.

Technologies

Microsoft Entra ID, Azure, Azure Policy, Terraform, Bicep, Microsoft 365, Microsoft Sentinel, Microsoft Defender, Defender for Cloud, Microsoft Secure Score, CIS Benchmarks, Zoho ServiceDesk, PowerShell, Microsoft Graph, Python, Azure CLI, Power Automate, Logic Apps, REST APIs, Exchange Online, Mimecast, Zscaler, Azure Key Vault, RBAC, Microsoft Purview, DLP, SharePoint, OneDrive, Intune, Microsoft Sentinel detection rules, Microsoft Sentinel data connectors, GitHub, GitHub Actions, SAML, OIDC, SCIM, MFA, passwordless authentication, Conditional Access, identity protection, least-privilege RBAC, API permissions and admin consent, certificate and secret expiration, branch protection, secret scanning, OIDC federation, SOCs (managed 24/7 SOC provider), SOC 2, ISO 27001, NIST CSF, CIS, AWS, ARM, Git, Active Directory, Entra Connect, Cloud Sync, Multi-Geo

Location and Schedule

• Primarily remote, with in-person work when required.
• Eastern Time Zone, in the Northeast or Southeast US.
• Occasional travel for projects or company events.

Nice to Have

• Certifications such as Microsoft SC-300, AZ-104, AZ-500, AZ-305, GitHub Administration, or AWS Solutions Architect – Associate.
• Working knowledge of AWS, including IAM, IAM Identity Center federation with Entra ID, AWS Organizations, and core security services such as CloudTrail, GuardDuty, and Security Hub.
• Experience administering Jira, including Atlassian Guard, or Linear.
• Experience in professional services, accounting, or financial services, including supporting client audits and security questionnaires.

AI Tools Notice

CFG I may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist the recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans.

If you would like more information about how your data is processed, please contact us.