Senior Cloud Systems Engineer

OverviewAt MoFo, we couldn’t write our own success story without yours.Ready to write your story?Join MoFo as aSenior Cloud Systems Engineeron our Information Technology team!This role can be based in San Francisco, Palo Alto, Los Angeles, San Diego, Austin, New York, Boston or Washington D.C.ABOUT THE ROLEThe Senior Cloud Systems Engineer is responsible for the architecture, engineering, security, and operation of the Firm’s Microsoft Azure environment and Microsoft Entra identity platform. This individual will serve as a senior technical authority for Azure landing zones, governance, networking, and resiliency, and for Microsoft Entra ID identity and access management, including Conditional Access, authentication, privileged access, and application integration. They will manage cloud endpoint and virtual desktop services, including Microsoft Intune and Azure Virtual Desktop. They will lead cloud infrastructure projects from conception through Firm-wide deployment, automating build and operations through infrastructure as code and scripting.Microsoft Azure Platform EngineeringArchitects and maintains the Firm’s Microsoft Azure environment, including landing zones, management group hierarchy, and subscription design, in alignment with the Cloud Adoption and Well-Architected Frameworks.Establishes and enforces cloud governance through Azure Policy, role-based access control (RBAC), and naming and tagging standards; remediates non-compliance across all subscriptions.Designs, builds, and supports Azure infrastructure and platform services, including virtual machines and scale sets, App Service, Azure SQL, Azure Storage, and Key Vault.Engineers Azure networking, including hub-and-spoke topology, network security groups, private endpoints, Private DNS, VPN Gateway and ExpressRoute, and Azure Front Door with Web Application Firewall.Builds and maintains hardened, standardized virtual machine images with Azure VM Image Builder and Azure Compute Gallery; keeps Azure-hosted servers patched through Azure Update Manager.Designs for resiliency using availability zones, paired regions, Azure Backup, and Azure Site Recovery; performs backup, restore, data migration, and disaster recovery testing.In partnership with Information Security, implements cloud security controls, including Microsoft Defender for Cloud, managed identities, Key Vault, and least-privilege access, and remediates findings.Monitors platform health, performance, capacity, and cost using Azure Monitor, Log Analytics, and Azure Cost Management; supports the Firm’s Cloud FinOps practice through rightsizing, reservations, and cost allocation.Develops infrastructure as code (Bicep, ARM, and/or Terraform) and PowerShell automation using Azure Resource Manager and Microsoft Graph REST APIs, delivering repeatable, self-service deployment patterns within governance guardrails.Microsoft Entra Identity and Access ManagementServes as senior administrator and subject matter expert for the Firm’s Microsoft Entra ID tenant, including identity architecture, tenant configuration, and least-privilege delegated administration.In partnership with Information Security, designs and maintains Conditional Access policies, including authentication strengths, device compliance, and Continuous Access Evaluation; validates changes in report-only mode before enforcement.Leads the Firm’s adoption of phishing-resistant and passwordless authentication, including Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, and certificate-based authentication.Administers Privileged Identity Management (PIM) for just-in-time access to Entra and Azure roles, and maintains emergency access accounts.Integrates applications with Entra ID using SAML, OpenID Connect, and OAuth 2.0 single sign-on and SCIM provisioning; governs app registrations, API permissions, and consent.Manages workload identities, including service principals, managed identities, and workload identity federation, and their secret and certificate lifecycles.Manages hybrid identity, including Microsoft Entra Connect synchronization with Active Directory Domain Services and Microsoft Entra Kerberos, while advancing the Firm’s transition to cloud-native identity.Administers identity governance, including access reviews, entitlement management, dynamic groups, and group-based licensing, as well as B2B guest access and cross-tenant access settings.Investigates risky users and sign-ins with Microsoft Entra ID Protection; troubleshoots complex authentication and Conditional Access issues through sign-in and audit log analysis; automates identity tasks with Microsoft Graph.Endpoint and Virtual Desktop ServicesManages Microsoft Intune for Windows and mobile endpoints, including Windows Autopilot, compliance and configuration policies, security baselines, application packaging and deployment, and Windows Update for Business and Windows Autopatch.Engineers and supports Azure Virtual Desktop, including host pools, session host images, scaling plans, and FSLogix profile containers on Azure Files.Leads the design and support of infrastructure for AI solutions, including Microsoft 365 Copilot and Azure-hosted AI services, in alignment with Firm security and information governance requirements.Operations and SupportProvides Tier III support; accepts, responds to, and resolves escalated incidents on a timely basis, engaging Microsoft and other providers as needed. Monitors team incidents to ensure SLAs and OLAs are met and communicates resolution to users.Participates in Problem and Knowledge Management initiatives, including root cause analysis of major incidents.Adheres to departmental policies such as thorough testing and rollback plans and adherence to maintenance windows, and observes Change Management policies and procedures.Works closely with Information Security, application owners, and office technology staff to maintain production, development, and test environments; provides technical guidance and mentoring to other IT analysts and engineers.Prepares and maintains technical documentation, including architecture diagrams and runbooks; ensures non-technical decision makers understand technical matters.Responds to after-hours escalations as needed.ABOUT YOUBachelor’s Degree in Computer Science, Information Systems, or related field, or equivalent education and work experience.A minimum of eight years of enterprise systems engineering experience, including at least five years engineering and administering Microsoft Azure and Microsoft Entra ID (formerly Azure Active Directory).Enterprise experience (2,000+ users in multiple geographic locations) required. Large law firm experience desired.Demonstrated experience leading large-scale cloud migration, modernization, or identity initiatives.Microsoft certifications strongly preferred, including Azure Administrator Associate (AZ-104), Azure Solutions Architect Expert (AZ-305), and Identity and Access Administrator Associate (SC-300). Additional certifications such as SC-500 (or legacy AZ-500), AZ-700, AZ-140, or MD-102 a plus.Microsoft Azure and Microsoft Entra ExpertiseExpert-level knowledge of Microsoft Azure architecture, governance, networking, and platform services, including landing zones, Azure Policy, RBAC, hub-and-spoke networking, Private Link, and private DNS.Expert-level knowledge of Microsoft Entra ID, including Conditional Access, passwordless authentication, Privileged Identity Management, ID Protection, identity governance, and B2B collaboration.Deep understanding of modern authentication and application identity (SAML, OpenID Connect, OAuth 2.0, SCIM, and workload identities) and of hybrid identity with Entra Connect, Active Directory Domain Services, and Kerberos.Experience with Microsoft Intune, Windows Autopilot, Azure Virtual Desktop, and the Microsoft Defender portfolio.Advanced PowerShell scripting skills, including direct use of Azure Resource Manager and Microsoft Graph REST APIs; Python and Azure CLI experience a plus.Experience with infrastructure as code (Bicep, ARM, and/or Terraform), Git source control, and CI/CD pipelines using GitHub Actions or Azure DevOps.Working knowledge of Azure Monitor, Log Analytics and KQL, Azure Cost Management, and core network technologies, including TCP/IP, DNS, TLS, and PKI.ABOUT MOFOAt MoFo, we collaborate as one firm, across borders, practice areas, and business functions and value fresh ideas and innovation over conformity and competition.About Us:Inclusion + Engagement:Commitment to Pro Bono:The MoFo Foundation:ABOUT OUR BENEFITSMoFo offers a comprehensive benefits package starting on your first day.Avariety of options for medical, dental, vision, life and disability coverage to meet the needs of you and your family.Industry-leading parental leave and family benefits including adoption and fertility treatment options and backup child and elder care.Global wellness program, including free access to Talkspace and Calm apps.Annual community service day to make an impact on your community and a birthday holiday just for fun.Education reimbursement annually.Dedicated Talent Development team.Competitive annual profit-sharing contribution.Where required by law, salary ranges are stated below. Additional compensation may include a discretionary bonus, overtime as applicable, health/welfare benefits, retirement contributions, paid holidays, and PTO. The range displayed is specifically for positions performed in those cities/states and may vary based on factors including but not limited to the following: local market data and ranges; an applicant's skills and prior relevant experience; and certain degrees, licensing, and certifications. We will consider qualified applicants with criminal histories in a manner consistent with all applicable federal, state, and local laws, including Fair Chance Laws and Ordinances.San Francisco, Palo Alto, New York salary range: $140k to $185kLos Angeles, San Diego, Boston, Washington D.C., salary range: $133k to $180kFor questions regarding this position, please View email address on click.appcast.io