Cloud platform architecture & landing zones
- Design Enterprise‑Scale Azure Landing Zones per CAF (management groups, subscription strategy, naming/tagging).
- Engineer guardrails using Azure Policy/initiatives and automate subscription vending with Bicep/Terraform.
Data protection & key management
- Enforce encryption by default; apply CMK for PaaS; govern secrets/certificates with Azure Key Vault.
- Adopt Microsoft Purview‑aligned protection patterns and define DR/backup guardrails for critical data services.
Container & platform hardening
- Define AKS standards (policy for Kubernetes, RBAC, network policies, ACR signing/scanning gates).
- Secure PaaS (App Service, Functions, Storage, SQL, Cosmos DB) with least privilege and network isolation.
Identity & privileged access (Microsoft Entra)
- Establish Conditional Access baselines, authentication strengths, workload identities and B2B collaboration.
- Implement PIM (just‑in‑time), RBAC/ABAC models, break‑glass design and access reviews.
Network & perimeter security
- Architect hub‑and‑spoke or Virtual WAN with zero‑trust segmentation.
- Implement Private Link/Endpoints, Azure Firewall/WAF, DDoS Protection, and NSG/ASG/egress controls.
Posture & compliance (build‑time/run‑time)
- Own Defender for Cloud CSPM enablement and risk‑based remediation (agentless assessments, vuln management).
- Map controls to CIS Azure, Microsoft Cloud Security Benchmark and NIST CSF 2.0; run exceptions/RA processes.
DevSecOps guardrails & automation
- Integrate security in CI/CD: IaC policy checks, code‑to‑cloud mapping and signed artifacts.
- Automate platform changes with Bicep/Terraform, GitOps and change approvals; publish reusable modules.
Collaboration & handover
- Lead multi‑disciplinary teams, coach consultants and communicate design trade‑offs to senior stakeholders.
Impact you’ll make in the first months
- Accelerate secure landing zone rollout with automated subscription vending and policy packages.
- Reduce standing privileges via PIM and staged Conditional Access baselines.
- Improve secure score through prioritized CSPM remediation and IaC‑enforced guardrails.
