Security / Zero Trust Architect (Azure & Microsoft Fabric)
Engagement
Zero Trust Architecture infrastructure for a Microsoft Fabric estate at a federal credit union, supporting a Tableau-to-Power BI/Fabric migration
Seniority
Architect
Engagement context migrating ~120 Tableau reports to Power BI/Fabric, with a Snowflake enterprise data warehouse. Zero Trust is a client requirement, and every infrastructure change goes through the client’s Architecture Review Board (ARB) and Change Advisory Board (CAB). The Foundation Phase designs are already approved; this role implements and evidences them.
What this person will do
Confirm the Zero Trust control baseline, required evidence per control, and the client owner for each control domain.
Identity & access:
Entra ID group, persona, and administrative role structures; conditional access, MFA, and device/session controls for Fabric and Power BI; privileged access with just-in-time elevation and separation of duties; service principal, managed identity, and secret management patterns.
Data protection:
Microsoft Purview sensitivity labeling and information protection for Fabric/Power BI content; encryption, key management, and data residency alignment.
Tenant hardening:
Fabric tenant settings, sharing/export controls, and external access restrictions.
Auditability:
Audit logging, activity monitoring, and retention configuration.
Run a Microsoft Defender for Cloud security posture (CSPM) assessment with attack path analysis.
Execute control validation and capture supporting evidence; prepare change documentation for ARB/CAB.
Must-have experience
Azure security architecture in regulated financial services (banking, credit unions, or similar).
Entra ID conditional access, PIM/JIT, service identities, and workload identity security.
Microsoft Purview information protection and sensitivity labels applied to Power BI/Fabric.
Power BI/Fabric tenant security settings.
Defender for Cloud CSPM; experience producing control evidence for auditors or regulators.
Strongly preferred
NCUA/FFIEC familiarity; Snowflake security integration; SC-100, AZ-500, SC-300 certifications.