Infrastructure Architecture

Engagement

Zero Trust Architecture infrastructure for a Microsoft Fabric estate at a federal credit union, supporting a Tableau-to-Power BI/Fabric migration

Seniority: Architect

Engagement context

migrating ~120 Tableau reports to Power BI/Fabric, with a Snowflake enterprise data warehouse. Zero Trust is a client requirement, and every infrastructure change goes through the client’s Architecture Review Board (ARB) and Change Advisory Board (CAB). The Foundation Phase designs are already approved; this role implements and evidences them.

What this person will do

• Confirm the Zero Trust control baseline, required evidence per control, and the client owner for each control domain.
• Identity & access: Entra ID group, persona, and administrative role structures; conditional access, MFA, and device/session controls for Fabric and Power BI; privileged access with just-in-time elevation and separation of duties; service principal, managed identity, and secret management patterns.
• Data protection: Microsoft Purview sensitivity labeling and information protection for Fabric/Power BI content; encryption, key management, and data residency alignment.
• Tenant hardening: Fabric tenant settings, sharing/export controls, and external access restrictions.
• Auditability: Audit logging, activity monitoring, and retention configuration.
• Run a Microsoft Defender for Cloud security posture (CSPM) assessment with attack path analysis.
• Execute control validation and capture supporting evidence; prepare change documentation for ARB/CAB.

Must-have experience

• Azure security architecture in regulated financial services (banking, credit unions, or similar).
• Entra ID conditional access, PIM/JIT, service identities, and workload identity security.
• Microsoft Purview information protection and sensitivity labels applied to Power BI/Fabric.
• Power BI/Fabric tenant security settings.
• Defender for Cloud CSPM; experience producing control evidence for auditors or regulators.

Strongly preferred

• NCUA/FFIEC familiarity; Snowflake security integration; SC-100, AZ-500, SC-300 certifications.

Not a fit if...

• General Azure security background with no Power BI/Fabric tenant experience.