Senior Cloud Systems Engineer

Morrison & Foerster, LLP•Washington, DC

About The Position

The Senior Cloud Systems Engineer is responsible for the architecture, engineering, security, and operation of the Firm’s Microsoft Azure environment and Microsoft Entra identity platform. The role serves as a senior technical authority for Azure landing zones, governance, networking, and resiliency, and for Microsoft Entra ID identity and access management, including Conditional Access, authentication, privileged access, and application integration. The engineer also manages cloud endpoint and virtual desktop services, including Microsoft Intune and Azure Virtual Desktop, and leads cloud infrastructure projects from conception through Firm-wide deployment. Build and operations are automated through infrastructure as code and scripting. The role architects and maintains Azure infrastructure and platform services, establishes cloud governance and security controls, designs resilient networking and recovery capabilities, monitors platform performance and cost, and develops repeatable deployment patterns. It administers the Firm’s Entra ID tenant and identity governance, modern authentication, application integrations, workload identities, and hybrid identity. It also manages Windows and mobile endpoint services and Azure Virtual Desktop, and leads infrastructure support for AI solutions in alignment with security and information governance requirements. The engineer provides Tier III support and responds to escalated incidents, participates in problem and knowledge management, follows change-management and maintenance procedures, works with Information Security and other technology teams, and maintains technical documentation. The position can be based in San Francisco, Palo Alto, Los Angeles, San Diego, Austin, New York, Boston, or Washington, D.C. After-hours escalations may be required.

Requirements

Bachelor’s degree in Computer Science, Information Systems, or a related field, or equivalent education and work experience.
At least eight years of enterprise systems engineering experience, including at least five years engineering and administering Microsoft Azure and Microsoft Entra ID.
Enterprise experience supporting 2,000 or more users across multiple geographic locations.
Demonstrated experience leading large-scale cloud migration, modernization, or identity initiatives.
Expert-level knowledge of Azure architecture, governance, networking, and platform services, including landing zones, Azure Policy, RBAC, hub-and-spoke networking, Private Link, and private DNS.
Expert-level knowledge of Microsoft Entra ID, including Conditional Access, passwordless authentication, Privileged Identity Management, ID Protection, identity governance, and B2B collaboration.
Deep understanding of modern authentication and application identity standards and technologies, including SAML, OpenID Connect, OAuth 2.0, SCIM, and workload identities.
Deep understanding of hybrid identity with Entra Connect, Active Directory Domain Services, and Kerberos.
Experience with Microsoft Intune, Windows Autopilot, Azure Virtual Desktop, and the Microsoft Defender portfolio.
Advanced PowerShell scripting skills, including direct use of Azure Resource Manager and Microsoft Graph REST APIs.
Experience with infrastructure as code (Bicep, ARM, and/or Terraform), Git source control, and CI/CD pipelines using GitHub Actions or Azure DevOps.
Working knowledge of Azure Monitor, Log Analytics and KQL, Azure Cost Management, and core network technologies, including TCP/IP, DNS, TLS, and PKI.

Nice To Haves

Large law firm experience.
Microsoft certifications are strongly preferred, including Azure Administrator Associate (AZ-104), Azure Solutions Architect Expert (AZ-305), and Identity and Access Administrator Associate (SC-300).
Additional certifications such as SC-500 (or legacy AZ-500), AZ-700, AZ-140, or MD-102.
Python and Azure CLI experience.

Responsibilities

Architect and maintain the Firm’s Microsoft Azure environment, including landing zones, management group hierarchy, and subscription design.
Establish and enforce cloud governance using Azure Policy, RBAC, and naming and tagging standards, and remediate non-compliance.
Design, build, and support Azure infrastructure and platform services, including virtual machines, scale sets, App Service, Azure SQL, Azure Storage, and Key Vault.
Engineer Azure networking, including hub-and-spoke topology, network security groups, private endpoints, Private DNS, VPN Gateway, ExpressRoute, and Azure Front Door with Web Application Firewall.
Build and maintain hardened, standardized virtual machine images and keep Azure-hosted servers patched.
Design and test resiliency, backup, restore, data migration, and disaster recovery capabilities.
Implement cloud security controls with Information Security and remediate security findings.
Monitor platform health, performance, capacity, and cost; support cloud cost management through rightsizing, reservations, and cost allocation.
Develop infrastructure as code and PowerShell automation to deliver repeatable, self-service deployments within governance guardrails.
Administer the Firm’s Microsoft Entra ID tenant, identity architecture, tenant configuration, and delegated administration.
Design and maintain Conditional Access policies, validating changes in report-only mode before enforcement.
Lead adoption of phishing-resistant and passwordless authentication methods.
Administer Privileged Identity Management and maintain emergency access accounts.
Integrate applications with Entra ID using SAML, OpenID Connect, OAuth 2.0, and SCIM; govern app registrations, API permissions, and consent.
Manage workload identities and their secret and certificate lifecycles.
Manage hybrid identity and support the transition to cloud-native identity.
Administer identity governance, B2B guest access, and cross-tenant access settings.
Investigate risky users and sign-ins, troubleshoot authentication and Conditional Access issues, and automate identity tasks.
Manage Microsoft Intune for Windows and mobile endpoints, including Autopilot, policies, application deployment, and Windows update services.
Engineer and support Azure Virtual Desktop, including host pools, session host images, scaling plans, and FSLogix profile containers on Azure Files.
Lead design and support of infrastructure for AI solutions, including Microsoft 365 Copilot and Azure-hosted AI services.
Provide Tier III support, resolve escalated incidents, engage providers as needed, monitor service commitments, and communicate resolutions to users.
Participate in Problem and Knowledge Management, including root cause analysis of major incidents.
Follow testing, rollback, maintenance-window, and Change Management procedures.
Work with Information Security, application owners, and office technology staff to maintain production, development, and test environments; provide technical guidance and mentoring.
Prepare and maintain technical documentation, including architecture diagrams and runbooks, and explain technical matters to non-technical decision makers.
Respond to after-hours escalations as needed.

Benefits

Medical, dental, vision, life, and disability coverage.
Parental leave and family benefits, including adoption and fertility treatment options and backup child and elder care.
Global wellness program, including free access to Talkspace and Calm apps.
Annual community service day.
Birthday holiday.
Annual education reimbursement.
Dedicated Talent Development team.
Competitive annual profit-sharing contribution.
Discretionary bonus may be available.
Overtime compensation as applicable.
Retirement contributions.
Paid holidays and PTO.