Azure and Fabric Security Architect with ZTA (Zero Trust Architecture)

What this person will do

• Confirm the Zero Trust control baseline, required evidence per control, and the client owner for each control domain.
• Identity & access: Entra ID group, persona, and administrative role structures; conditional access, MFA, and device/session controls for Fabric and Power BI; privileged access with just-in-time elevation and separation of duties; service principal, managed identity, and secret management patterns.
• Data protection: Microsoft Purview sensitivity labeling and information protection for Fabric/Power BI content; encryption, key management, and data residency alignment.
• Tenant hardening: Fabric tenant settings, sharing/export controls, and external access restrictions.
• Auditability: Audit logging, activity monitoring, and retention configuration.
• Run a Microsoft Defender for Cloud security posture (CSPM) assessment with attack path analysis.
• Execute control validation and capture supporting evidence; prepare change documentation for ARB/CAB.

Must-have experience

• Azure security architecture in regulated financial services (banking, credit unions, or similar).
• Entra ID conditional access, PIM/JIT, service identities, and workload identity security.
• Microsoft Purview information protection and sensitivity labels applied to Power BI/Fabric.
• Power BI/Fabric tenant security settings.
• Defender for Cloud CSPM; experience producing control evidence for auditors or regulators.

Strongly preferred

• NCUA/FFIEC familiarity; Snowflake security integration; SC-100, AZ-500, SC-300 certifications.