Azure Cloud Security Architect

Planet Group; Milwaukee (WI); Hybrid; USD 172,000 - 179,000; Part time

Job summary

Planet Group is seeking an Azure Cloud Security Architect for a 3-month contract in Milwaukee, WI. This hybrid role focuses on cloud security, vulnerability remediation, infrastructure protection and governance during the transition.

The ideal candidate will lead security reviews, coordinate remediation across Azure, on-prem, and AD environments, and drive CSPM, data security, and IAM governance in a complex cloud migration.

Qualifications

• Experience securing Azure environments during cloud migrations.
• Knowledge of vulnerability remediation across cloud and on-premise estates.
• Ability to coordinate across security and engineering teams to enforce governance and posture controls.

Responsibilities

• Cloud Architecture & Vulnerability Baseline: Finalize Azure architecture security reviews and coordinate remediation of critical/high vulnerabilities; rescan hosting and identity environments (Azure, on-premises, AD) during transition.
• IaC & Penetration Testing Remediation: Perform static security scans on Azure AD IaC codebases and coordinate remediation of critical/high vulnerabilities from Azure penetration tests.
• Cloud Security Posture Management (CSPM) & SaaS Protection: Implement CSPM, conduct posture testing, remediate findings, and test post-remediation; integrate Falcon Shield for the Azure Jump Domain.
• Data Security & Repository Protection: Scan data repositories using Cyera, coordinate data tier expansions for migration pipelines, remediate data exposure vulnerabilities.
• Azure Databricks Security & Governance: Review TLS inspection exceptions with risk docs and ServiceNow sign-off; enforce private connectivity and private DNS; oversee GSOC logging ingestion and IAM access governance across Databricks workspaces.

Skills

Cloud security architecture

Vulnerability remediation

Cloud governance

IAM governance

Data security

Tools

CrowdStrike CSPM

Falcon Shield

Cyera

ServiceNow

Azure Firewall

Azure AD

Entra ID

Unity Catalog

GSOC logging

Azure Databricks

Job description

Job Title:Azure Cloud Security Architect
Duration: 3 month contract
Location:Milwaukee, WI Hybrid
Pay: $125-130/hr

This role will support cloud security, vulnerability remediation, infrastructure protection, and governance throughout the transition.

Key Responsibilities

• Cloud Architecture & Vulnerability Baseline: Finalize Azure architecture security reviews and coordinate with legacy infrastructure teams to remediate critical/high vulnerabilities identified in the security baseline. Rescan hosting and identity environments (Azure, on-premises datacenters, and Active Directory) transitioning to the new organization.

• IaC & Penetration Testing Remediation: Perform static security scans on Azure AD Infrastructure as Code (IaC) codebases. Coordinate remediation of critical/high vulnerabilities identified through Azure penetration testing.

• Cloud Security Posture Management (CSPM) & SaaS Protection: Implement CrowdStrike CSPM, conduct posture vulnerability testing, remediate critical findings, and perform post-remediation testing. Integrate Falcon Shield for the Azure Jump Domain.

• Data Security & Repository Protection: Scan data repositories using Cyera, coordinate data volume tier expansions for migration pipelines, and remediate identified data exposure vulnerabilities.

• Azure Databricks Security & Governance:

  • Review and secure approval for TLS inspection exceptions, including risk documentation, compensating controls, and ServiceNow sign-off.

  • Validate private-by-design architecture, enforcing VNet injection, Secure Cluster Connectivity (no public IPs), private endpoints, and private DNS.

  • Coordinate GSOC logging ingestion and retention policies, including 90-day blob storage retention before full GSOC integration.

  • Oversee Entra ID and IAM access governance for Databricks workspaces, Unity Catalog, service principals, and managed identities.

  • Ensure centralized egress routing through Azure Firewall for all approved external integrations.