Network/Cloud Infrastructure Security Engineer

CFGI

3d•Remote

About The Position

CFGI is seeking a full-time Network/Cloud Infrastructure Security Engineer for its corporate Information Technology department. Reporting to the Director of Information Technology, this hands-on role owns identity, access, and cloud foundations supporting more than 1,400 users across domestic and international offices. The engineer works with Microsoft Entra ID, Azure, GitHub, Linear, Jira, and other business-critical applications. The role translates security expectations for a professional services firm handling sensitive client financial data into practical, documented controls. It is the primary resource for Identity and Access Management (IAM) and infrastructure requests from product development, an escalation point for the IT team, and a partner to IT Service Management and functions across the firm. The engineer designs and maintains secure Azure infrastructure, identity and access controls, security and data-protection measures, and automations. The role supports incident response, compliance and client assurance, vendor security evaluations, documentation, change management, and knowledge transfer. The position is primarily remote, with in-person work when required, and is based in the Eastern Time Zone in the Northeast or Southeast United States. Occasional travel may be required for projects or company events.

Requirements

At least 5 years of experience in cloud infrastructure, systems engineering, identity, or security engineering.
Experience administering and engineering Microsoft 365 and Azure environments, including at least 2 years of hands-on experience.
Working knowledge of information security control frameworks.
Bachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent professional experience.
Experience engineering identity and access controls, including conditional access, multifactor authentication, privileged identity management, role-based access, enterprise application integration, and hybrid identity.
Experience administering cloud infrastructure, including networking, compute, storage, and resource governance.
Experience administering source-code hosting organizations, including single sign-on, automated provisioning, team-based permissions, branch protection, secret scanning, and secure credential handling for CI/CD workflows.
Proficiency in administrative scripting and API-based automation.
Experience with infrastructure as code and version control.
Experience with Microsoft Entra ID, including enterprise applications, app registrations, Active Directory, and Entra Connect / Cloud Sync.
Experience administering GitHub organizations and securing GitHub Actions.
Proficiency with PowerShell and Microsoft Graph.
Experience with Terraform, Bicep, or ARM, and Git.
Working knowledge of frameworks such as CIS, NIST CSF, SOC 2, or ISO 27001.

Nice To Haves

Certifications such as Microsoft SC-300, AZ-104, AZ-500, AZ-305, GitHub Administration, or AWS Solutions Architect – Associate.
Working knowledge of AWS, including IAM, IAM Identity Center federation with Entra ID, AWS Organizations, and core security services such as CloudTrail, GuardDuty, and Security Hub.
Experience administering Jira, including Atlassian Guard, or Linear.
Experience in professional services, accounting, or financial services, including supporting client audits and security questionnaires.

Responsibilities

Design, build, and maintain secure Azure environments, including landing zones, subscription structure, networking, and resource governance.
Implement and manage infrastructure as code using Terraform and Bicep, and use Azure Policy to maintain consistent, governed, and auditable cloud environments.
Plan and execute tenant, domain, and workload migrations, including Microsoft 365 tenant-to-tenant moves related to acquisitions and expansion.
Maintain backup and disaster recovery for critical systems, and plan for potential future multi-cloud expansion, such as AWS.
Administer and improve Microsoft Entra ID, including Conditional Access, MFA and passwordless authentication, identity protection, and least-privilege RBAC across Azure and Microsoft 365.
Create and manage Entra ID enterprise applications and app registrations, including SAML/OIDC SSO, SCIM provisioning, API permissions and admin consent, app owners, and certificate and secret expiration.
Manage identity and access for GitHub, Linear, and Jira, including Entra ID SSO, SCIM provisioning, team and project permissions, access reviews, and timely offboarding.
Enforce GitHub security practices, including branch protection, required reviews, secret scanning, OIDC federation from GitHub Actions to Azure, and audit log streaming to Microsoft Sentinel.
Handle IAM requests from product development and act as an escalation point for IT infrastructure and IAM tickets tracked through Zoho ServiceDesk.
Manage guest and external access for client collaboration in Teams and SharePoint while balancing productivity and confidentiality.
Design and improve security controls across Microsoft Defender and Defender for Cloud, and remediate posture findings using Microsoft Secure Score and CIS Benchmarks.
Manage Microsoft Sentinel data connectors and detection rules, and lead response to cloud and identity threats alongside the Director of IT and the firm’s managed 24/7 SOC provider.
Secure email, web, and SaaS access through Exchange Online, Mimecast, and Zscaler policy design.
Create and manage Azure Key Vaults, including RBAC-based access, managed identity integration, and rotation and expiration monitoring for secrets, certificates, and keys.
Design SharePoint and OneDrive permissions, Multi-Geo data residency, and Microsoft Purview sensitivity labels, DLP, and retention policies.
Automate administrative and security tasks using PowerShell, Microsoft Graph, Python, and Azure CLI.
Build workflow automations with Power Automate, Logic Apps, and REST APIs across IT and business platforms.
Ensure AI tools and integrations meet CFGI’s identity, data, and security standards.
Provide architecture documentation and technical evidence for SOC 2, ISO 27001, and client-driven security reviews.
Support responses to client security questionnaires and due diligence requests concerning cloud, identity, and data-protection controls.
Evaluate the security of new vendors and SaaS applications before connecting them to CFGI’s identity provider or data.
Maintain architecture diagrams, standards, runbooks, and change records, following change management practices for owned environments.
Train IT Specialists on identity, Intune, and cloud administration.