Cloud Platform Architect

Mizuho•New York, NY

2d•$112,000 - $205,000•Hybrid

About The Position

We are hiring a Cloud Platform Architect specializing in identity to own cloud identity as a platform capability within our Cloud Platform team. You will take ownership of our Microsoft Entra estate and everything from the synchronization boundary up: authentication design, access policy, hybrid identity, and the identity patterns the rest of the platform builds on. The platform operates on an enablement model: guardrails enforced in code and self-serve patterns as the default path. Your job is to make secure identity the easiest option, not a queue. This is a role for someone who wants a domain of their own: full technical ownership of cloud identity in a regulated financial environment, a direct line into platform and architecture decisions, and a roadmap that includes building our external identity capability from the ground up.

Requirements

7+ years in identity or infrastructure engineering, including deep hands-on Microsoft Entra ID experience at enterprise scale
Proven experience in regulated financial services (banking, capital markets, or insurance) or a comparably regulated environment
Strong command of Conditional Access design, Privileged Identity Management, hybrid identity (Entra Connect / cloud sync), and workload identity patterns
Experience taking ownership of an established identity estate and maturing its configuration, documentation, and controls
Working knowledge of authentication standards (OIDC, OAuth 2.0, SAML) and modern authentication policy (phishing-resistant MFA, token protection)
Solid working knowledge of the broader Azure platform: RBAC, Azure Policy, Key Vault, and how identity integrates with core infrastructure services
Familiarity with control frameworks and regulatory expectations for identity and access management
Scripting and automation proficiency (PowerShell, Microsoft Graph API); Infrastructure-as-Code experience preferred

Nice To Haves

You build a defensible picture of an environment before changing anything in it
You know what you chose not to enforce, and why: policy design for you is about blast radius and rollout, not checklists
You have made an identity control easier to follow instead of easier to bypass
Your last hands-on work was recent, and you intend to keep it that way

Responsibilities

Design and operate secure, compliant identity for our Azure estate using Microsoft Entra ID, aligned to regulatory and internal audit requirements, including access control and MFA provisions
Design, implement, and iterate Conditional Access policies, Privileged Identity Management, and entitlement management across the tenant
Publish identity standards as both clear documentation and consumable patterns: reference designs, reusable Terraform modules, and paved-road configurations that make the standard the easiest path to follow
Enforce identity guardrails through Azure Policy and automation rather than manual approval
Own hybrid identity and the technical interface with the directory services team: Entra Connect scope, what synchronizes, what stays cloud-only, and how the boundary is controlled
Design workload identity patterns for Azure services and pipelines: managed identities, workload identity federation, and service principal lifecycle
Partner with Security, Risk, and Compliance to integrate regulatory controls and evidence collection into identity designs
Represent cloud identity in audit and regulatory conversations