Azure Cloud Architect

You will serve as the lead Azure Cloud Architect responsible for designing and implementing a Zero Trust–aligned security architecture across a multi‑subscription Azure enterprise environment. This role focuses on securing AI Foundry , Azure Kubernetes Service (AKS) , Microsoft Fabric , and the broader Azure tenant using industry frameworks including NIST 800‑53 , NIST CSF , ISO 27001 , SOC 2 , and Insurance Regulator (NAIC Model 668 / NYDFS 500) requirements.

You will define the security blueprint, enforce governance, design identity boundaries, implement policy‑driven controls, and ensure all AI and cloud workloads meet enterprise and regulatory standards.

Key Responsibilities

1. Azure Tenant & Zero Trust Architecture

• Architect and implement a Zero Trust security model across identity, network, data, and workload layers.
• Design Azure management group hierarchy , subscription strategy, and landing zones aligned to NIST/ISO controls.
• Implement Conditional Access , PIM , Identity Governance , and segmented identity boundaries for developers, admins, and workloads.
• Lead the rollout of Azure Policy , policy initiatives , RBAC , and custom role definitions for least‑privilege enforcement.
• Establish secure-by-default patterns for all cloud services.

2. AI Foundry Security & Governance

• Architect secure environments for AI Foundry , including:
• Model training and serving isolation, Data access governance, Key Vault integration
• Private endpoints and network isolation
• Implement AI safety, lineage, and audit controls aligned with regulatory expectations.
• Define secure patterns for prompt flows, agents, vector stores, and model endpoints .

3. AKS Security Architecture

• Design hardened AKS clusters with:
• Azure CNI , network policies , pod identity , OPA/Gatekeeper , secretless workloads
• Workload identity with Entra ID
• Implement Zero Trust for microservices , including: mTLS, API gateway patterns,Service mesh (Istio/Linkerd) optional
• Define secure CI/CD patterns using OIDC , GitHub Actions, and policy‑driven deployments.

4. Microsoft Fabric Security

• Architect secure Fabric workspaces, pipelines, and lakehouses.
• Implement:
• Managed VNETs, Private endpoints
• Ensure Fabric aligns with data residency , retention , and insurance regulatory requirements.

5. Data Protection & Key Management

• Implement enterprise‑wide Key Vault , Managed HSM , and secret rotation patterns.
• Data at rest, Data in transit, Model artifacts, AKS secrets and Fabric data
• Build automated detection and response patterns for:

7. Compliance & Regulatory Alignment

• ISO 27001, SOC 2
• Produce architecture documentation, control evidence, and audit‑ready artifacts.
• Partner with risk, compliance, and internal audit teams.

Required Skills & Experience

• 15+ years in cloud architecture with deep expertise in Azure .
• Proven experience implementing Zero Trust in enterprise environments.
• Hands‑on experience with:
• AKS (production-grade)
• Microsoft Fabric
• AI Foundry or Azure ML
• Strong understanding of network segmentation , identity governance , and data protection .
• Experience with Bicep , Terraform , or ARM templates.
• Strong knowledge of NIST/ISO frameworks and regulatory controls.

Preferred Qualifications

• SC‑100 (Cybersecurity Architect)
• Experience in insurance , financial services , or other regulated industries.
• Experience with GitHub OIDC , DevSecOps, and policy‑as‑code.

Success Criteria

• Azure tenant fully aligned to Zero Trust principles.
• AI Foundry, AKS, and Fabric workloads fully secured and compliant.
• Automated governance and policy enforcement across all environments.
• Audit‑ready documentation and evidence for regulators.
• Secure, scalable patterns adopted across engineering teams.