Azure Cloud Security Architect

High Bridge Consulting•King of Prussia, PA

6d•Hybrid

About The Position

The Azure Cloud Security Architect will support the migration of an acquired company's Azure environment and Databricks platform into the client's environment. The role is based in the client's King of Prussia, Pennsylvania office with a hybrid work arrangement and flexible work-from-home options. Its primary focus is Azure cloud security, vulnerability remediation, cloud security posture, data security, and securing Azure Databricks environments. The architect will work with cloud, infrastructure, security, and legacy teams to identify security issues, coordinate remediation, and help ensure the new environment meets the client's security standards. The role covers security architecture reviews across Azure, on-premises data centers, and Active Directory/Entra ID; Infrastructure-as-Code security reviews and penetration-testing findings; cloud security posture assessments using CrowdStrike CSPM; and data security scanning with Cyera. A significant focus is ensuring Azure Databricks is deployed and operated with a private, secure architecture, governed identity and access, approved network routing, and appropriate logging and retention. The architect will also document and coordinate security exceptions and required approvals through ServiceNow.

Responsibilities

Review Azure cloud architecture from a security perspective and identify security issues across Azure, on-premises data centers, and Active Directory/Entra ID.
Help remediate critical and high-severity vulnerabilities, coordinate remediation with existing teams, and perform follow-up scans.
Perform security reviews and scans of Infrastructure-as-Code (IaC).
Review Azure security findings from penetration testing, coordinate remediation of critical and high vulnerabilities, and validate that vulnerabilities have been resolved.
Implement and work with CrowdStrike CSPM to perform cloud security posture assessments, prioritize and remediate critical findings, and retest environments after remediation.
Support integration of CrowdStrike Falcon Shield for the Azure Jump Domain.
Use Cyera to scan data repositories for security and exposure risks, identify data security issues, and coordinate remediation.
Support data-volume expansion required for migration pipelines.
Secure the Azure Databricks environment using a private architecture, validating VNet Injection, Secure Cluster Connectivity, absence of public IP addresses, Private Endpoints, and Private DNS.
Review and govern Entra ID/IAM access for Databricks workspaces, Unity Catalog, service principals, and managed identities.
Ensure approved external integrations use centralized Azure Firewall routing.
Support security logging and retention requirements.
Review and document security exceptions, including TLS inspection exceptions.
Coordinate required security approvals and documentation through ServiceNow.