Azure Cloud Security

Tech Mahindra; Toronto; On-site; CAD 100,000 - 120,000; Full time

Benefits offered by this job

Medical insurance

Vision insurance

Dental insurance

Life insurance

Disability insurance

Paid time off

Job summary

Tech Mahindra in Canada seeks a Cloud Security Engineer to own remediation lifecycle and governance across Azure environments. You will implement and tune Conditional Access policies, manage Microsoft Entra ID, Defender for Cloud, and policy as code with Terraform, delivering measurable risk reductions and secure baselines.

Experience with AI security considerations and CI/CD security is a plus; scripting in PowerShell or Python is beneficial.

Qualifications

• 5+ years in cloud security or security engineering, with deep Azure experience.
• Strong hands-on Entra ID expertise: app registrations, Enterprise Apps, permissions and consent, and Conditional Access.
• Solid knowledge of modern authentication: OIDC, OAuth 2.0 / PKCE, JWT, and mTLS.
• Proficiency with Terraform and Azure Policy for policy as code and guardrails.
• Experience with Defender for Cloud and cloud security posture management.

Responsibilities

• Own the full lifecycle of security findings and recommendations from triage through remediation and closure.
• Secure and govern authentication flows across Azure Entra ID and implement and tune Conditional Access policies.
• Build and enforce guardrails using Terraform; maintain secure by default IaC baselines and detect drift.
• Secure cloud admin portals (Azure and Microsoft 365 admin) and strengthen privileged access controls.
• Apply security controls to AI workloads and agents; manage risk of prompt injection and data exposure.

Skills

Cloud security

Azure security

Entra ID expertise

OAuth 2.0 / OIDC

Terraform

Tools

Terraform

Azure Policy

Microsoft Defender for Cloud

Job description

What you will do,

?????? Remediation & recurrence prevention (the core of this role)

Own the full lifecycle of security findings and recommendations whether they come from the security team, Microsoft Defender for Cloud, or other tooling through triage, remediation, verification, and closure.

Root cause recurring issues and implement systemic fixes (policy as code, automated guardrails, secure baselines) so the same findings donâ reappear quarter after quarter.

Track remediation SLAs and report on risk reduction and posture trends over time.

Identity & authentication

Secure and govern modern authentication flows across the estate: OIDC, OAuth 2.0 with PKCE, JWT validation and handling, and mTLS.

Administer and harden Microsoft Entra ID (Azure Entra): app registrations and Enterprise Application permissions, consent governance, service principals and managed identities, credential and secret hygiene, and least privilege scoping.

Design, implement, and continuously tune Conditional Access policies.

Cloud security engineering & governance

Build and enforce guardrails using Azure Policy and Terraform; maintain secure by default infrastructure as code baselines and detect/remediate configuration drift.

Operate Microsoft Defender for Cloud–drive secure score improvement, remediate recommendations, and manage cloud security posture (CSPM).

Contribute to security governance: standards, control definitions, exception handling, and audit evidence.

Admin portal & privileged access security

Secure all cloud and SaaS administrative portals–Azure and other admin consoles (e.g., Microsoft 365 admin, identity providers, and any additional cloud platforms in use).

Strengthen privileged access: MFA enforcement, Privileged Identity Management (PIM) / just in time elevation, role minimization, and break glass procedures.

AI security

Apply security controls to AI workloads, services, and AI agents: agent and workload identities, tool and permission scoping, data exposure and prompt injection risk, and emerging AI security best practices.

What You Bring (Required)

5+ years in cloud security or security engineering, with deep, hands on Azure experience.

Strong, hands on Microsoft Entra ID expertise: app registrations, Enterprise Apps, permissions and consent, and Conditional Access.

Solid working knowledge of modern authentication: OIDC, OAuth 2.0 / PKCE, JWT, and mTLS.

Proficiency with Terraform and Azure Policy for policy as code and automated guardrails.

Experience with Microsoft Defender for Cloud and cloud security posture management.

A demonstrable track record of root causing and permanently closing security findings–not just patching them.

Working understanding of AI, AI agents, and AI security considerations.

Nice to Have

Experience with CI/CD pipeline security, secrets management, and SIEM/SOAR.

Scripting/automation (PowerShell, Python).

Hands on experience securing LLM based or agentic systems in production.

Fulltime: The pay range for this role is CAD$100,000 - CA$120,000 per annum including any bonuses or variable pay. Tech Mahindra also offers benefits like medical, vision, dental, life, disability insurance and paid time off (including holidays, parental leave, and sick leave, as required by law). The exact offer terms will depend on the skill level, educational qualifications, experience and location of the candidate.

“AI tools may assist in the recruitment process; however, all hiring decisions are made by the recruitment team based on a comprehensive evaluation of candidates.