Principal Azure Security Solution Architect

About us:

Intuitive.AI is one of the fastest-growing (INC 5000, CRN) Cloud & SDx solution and services companies supporting enterprise customers on a global scale. Intuitive is an "Engineering Company" delivering measurable value and key business outcomes.

Intuitive Superpowers:

• DataOps & AI/ML

• Cloud Native, AppSecOps, DevSecOps

• Cloud Migration & Transformation

• Cloud FinOps

• Cybersecurity (App/Data/Infra) & GRC

• SDx & Digital Workspace

We are proud to partner with some of the world's leading enterprises and serve 200+ customers across different industry verticals. We have achieved many milestones along the way, including being recognized as a top-10 fast-growth 150 IT company in the Americas by CRN in 2022 and being named one of America's fastest-growing private companies by INC 5000 in 2022. That’s not all! Even CIO Review awarded us as the Most Promising Cloud Migration Company and Artificial Intelligence Solutions Provider in 2022.

About the job:

Title: Principal Cloud Security Solution Architect

Location: Remote across USA/ Canada

Position Type: Full Time/ Contract

Job Summary

We are seeking a Principal Cloud Security Solution Architect hands-on, individual-contributor technical expert who personally designs, builds, and owns security solutions on Microsoft Azure end to end. This is not a people-management or delivery-leadership role; it is a deep technical ownership role for someone who would rather be the one architecting and implementing the solution than managing the people who do. You will work directly with client technical stakeholders to understand their requirements and translate them into designs you personally own through implementation and validation.

The ideal candidate has designed and implemented security architectures for large, highly regulated enterprises organizations where the workloads carry sensitive records, significant regulatory exposure, and material business liability if security controls fail. Beyond core infrastructure and network security, you will personally own the architecture and implementation of security controls for Data, AI, and Analytics workloads data platforms, machine learning pipelines, generative AI services, and large-scale analytics environments ensuring these systems are designed, built, and hardened to the same rigor as traditional workloads.

As the principal technical owner on your engagements, you will drive solutions from initial design through hands-on build, configuration, and validation, serving as the direct technical counterpart to client architects, engineers, and security teams.

Key Responsibilities

Security Architecture & Solution Design

• Personally design, build, and own end-to-end security architectures across Azure environments, including multi-subscription, multi-tenant, and management-group landing zones for large enterprises.
• Design and implement secure landing zones and enterprise-scale foundations aligned to the Azure Cloud Adoption Framework and Well-Architected Framework (using tools such as Terraform, Bicep/ARM templates, and Azure Policy as code), and hand off working, documented solutions rather than PowerPoint architectures.
• Architect and build solutions for environments with sensitive records and elevated liability exposure including PII, PHI, PCI, financial transaction data, and government/critical-infrastructure data ensuring confidentiality, integrity, availability, and auditability are designed and implemented, not just specified.
• Conduct security architecture reviews and threat modeling for complex, cross-functional programs, and own remediation of findings through to implementation.
• Translate enterprise risk appetite and regulatory obligations into concrete, deployable Azure control designs and configurations that you build and validate yourself.

Data, AI & Analytics Workload Security

• Design and implement security architectures for enterprise data platforms on Azure including Azure Synapse Analytics, Azure Databricks, Azure Data Factory, Azure SQL Database/Managed Instance, Cosmos DB, and Azure Data Lake Storage covering data classification, encryption, tokenization, and column/row-level and attribute-based access control.
• Architect security and governance controls for AI/ML and generative AI workloads on Azure Machine Learning and Azure OpenAI Service / Azure AI Foundry, including model and endpoint access control, data lineage, training-data protection, content-safety and prompt/output controls, and secure MLOps pipelines.
• Design secure data governance architectures using Microsoft Purview (data catalog, classification, lineage, and Information Protection/DLP) that satisfy regulatory and contractual obligations for regulated data across its full lifecycle ingestion, processing, storage, model training, and consumption.
• Partner with data engineering, data science, and analytics teams to embed security and privacy-by-design controls into data and AI platform architecture without impeding delivery velocity.

Identity, Network, and Platform Security

• Design enterprise-wide identity and access management strategy on Azure Microsoft Entra ID (Azure AD), Conditional Access, Privileged Identity Management (PIM), and Workload Identity Federation for large, federated user and service populations.
• Architect network security for complex enterprise topologies, including hub-and-spoke and Virtual WAN designs, Network Security Groups/Azure Firewall, Private Link/Private Endpoints, ExpressRoute, and Azure Virtual Network segmentation to enforce data perimeters around sensitive workloads.
• Design security monitoring, detection, and incident response architecture using Microsoft Defender for Cloud, Microsoft Sentinel, and SIEM/SOAR integrations, ensuring coverage extends to data and AI platforms, not just infrastructure.

Governance, Risk & Compliance

• Partner with compliance, legal, privacy, and enterprise risk teams to ensure Azure architectures satisfy applicable frameworks and regulations (e.g., ISO 27001, NIST 800-53/CSF, SOC 2, PCI DSS, HIPAA/HITRUST, GDPR, FedRAMP, Microsoft Cloud Security Benchmark/CIS, and sector-specific regulatory regimes), using Azure Policy, Microsoft Purview Compliance Manager, and Defender for Cloud regulatory dashboards to operationalize them.

Client & Technical Stakeholder Engagement

• Act as the direct technical counterpart to client architects, engineers, and security teams gathering requirements, proposing solution designs, and building consensus on the technical approach.
• Communicate complex security architecture and implementation decisions clearly to both technical and non-technical stakeholders, without needing a delivery or program layer in between.
• Contribute reusable architecture patterns, Azure Policy definitions, and infrastructure-as-code modules from your own build work that other engagements can adopt.
• Stay current on the threat landscape and Azure platform evolution including emerging risks in AI/ML security and apply new capabilities directly into the solutions you design and build.

Qualifications

Experience & Education

• 10+ years in cybersecurity or cloud architecture roles, including 5+ years personally designing and implementing security solutions on Microsoft Azure at enterprise scale.
• Demonstrated experience operating at a Principal / Staff individual-contributor level recognized as a deep technical expert and go-to architect, not by number of direct reports.
• Proven, hands-on track record designing and implementing (not just advising on) architectures for environments handling sensitive records (PII/PHI/PCI/financial/government data) with meaningful regulatory and liability exposure.
• Comfortable being the sole or lead technical owner on an engagement able to move from requirements to design to hands-on build without a supporting architecture team.
• Bachelor’s degree in computer science, Information Security, or a related field; master’s degree a plus.

Technical Expertise

• Deep, hands-on expertise across the Azure security stack: Microsoft Entra ID, Conditional Access, PIM, Azure Key Vault (including Managed HSM), Microsoft Defender for Cloud, Microsoft Sentinel, Azure Policy, and Azure Blueprints/landing zone accelerators.
• Strong experience securing Data, AI, and Analytics workloads: Azure Synapse Analytics, Azure Databricks, Azure Data Factory, Cosmos DB, Azure SQL, Azure Machine Learning, Azure OpenAI Service, and Microsoft Purview, including data governance and AI-specific risk controls.
• Expertise in designing secure landing zones and enterprise-scale foundations for large, multi-subscription/multi-tenant Azure environments, including hybrid and multi-cloud connectivity patterns.
• Strong background in cloud-native and microservices security architecture (AKS, Azure Container Apps, App Service, API Management, service mesh).
• Proficiency with infrastructure-as-code and DevSecOps practices (Terraform and/or Bicep, Azure DevOps/GitHub Actions CI/CD, policy-as-code, shift-left security scanning).
• Working knowledge of AWS and/or GCP security architecture is a strong plus, to support multi-cloud and hybrid enterprise environments.

Governance & Communication

• In-depth knowledge of security frameworks and regulatory regimes relevant to highly regulated industries (ISO 27001, NIST, SOC 2, PCI DSS, HIPAA/HITRUST, GDPR, FedRAMP, Microsoft Cloud Security Benchmark, or equivalent), and experience operationalizing them through Azure Policy and Microsoft Purview Compliance Manager.
• Strong communication skills, able to work directly and effectively with client technical stakeholders (architects, engineers, security teams) as a peer, without relying on a program or delivery-management layer.