Technical Lead DevOps & Security

Job highlights

• Security engineering practice: . Default-deny and least-privilege as defaults. Fail-closed design (a control failure must never become a bypass).

About US:-

We turn customer challenges into growth opportunities. Material is a global strategy partner to the world s most recognizable brands and innovative companies. Our people around the globe thrive by helping organizations design and deliver rewarding customer experiences.

We use deep human insights, design innovation and data to create experiences powered by modern technology. Our approaches speed engagement and growth for the companies we work with and transform relationships between businesses and the people they serve.

Srijan, a Material company, is a renowned global digital engineering firm with a reputation for solving complex technology problems using their deep technology expertise and leveraging strategic partnerships with top-tier technology partners. Be a part of an Awesome Tribe

Must-have skills:-

Azure platform security (primary):-

• Microsoft Entra ID (Azure AD): app registrations, service principals, OAuth2 scopes, delegated vs application permissions, On-Behalf-Of (OBO) token flows, consent model, resource-scoped permissions (Exchange App RBAC, RSC-style scoping)
• Azure API Management (APIM): authoring and staging policies, per-client policy keyed on client ID, correlation-ID handling, content-safety and token-limit policies
• Azure networking: NSGs, firewall / egress rules, private endpoints / private connectivity, subnet segmentation
• Azure observability: Azure Monitor diagnostic settings, Log Analytics, Microsoft Sentinel, OpenTelemetry, KQL for validation and evidence queries

Engineering and DevOps:-

• Reading and reasoning about application source code to derive least-privilege scope (which MCP servers, tools, and Graph resources an agent actually calls, read vs write, target resources). This is the load-bearing skill for DC-IAM-1
• Building a shared instrumentation library / SDK (structured event emission, schema conformance, mandatory-by-design)
• CI/CD and staged promotion through environments (DEV to UAT), infrastructure-as-config discipline
• Comfort with a native-first, GA-only stance: prefer existing generally-available Azure controls over custom code; no preview-tier dependencies

Security engineering practice:

• Default-deny and least-privilege as defaults
• Fail-closed design (a control failure must never become a bypass)
• Proving enforcement with a negative test (the disallowed path is shown to be blocked, not just the allowed path working)
• Producing audit-grade evidence: before/after permission exports, allow/deny matrices, tamper/bypass tests, control-design and procedure writeups

Nice to Have:-

• PlainID or another externalized policy decision point (PDP) / policy-based access control
• AI agent platforms, LLM gateways, MCP (Model Context Protocol) hubs and connectors
• LangSmith or similar LLM tracing tools Postgres (the MCP hub registration / scope model runs on it)
• Prior work in a regulated / financial-services environment and familiarity with control-audit expectations (design gates, ARB / TRC / SOC sign-off)
• Guardrail and content-safety tooling (Azure Content Safety, Prompt Shields, Groundedness)

Working conditions and expectations

• Ground rules: native-first and GA-only; default-deny; fail closed for high-risk; one correlation ID end to end; confirm before changing shared platform config (APIM, network, identity changes affect every agent, so stage in DEV/UAT and validate before handoff)
• Release model: build and stage each control through DEV then UAT, complete positive and negative validation and sign-off at UAT, then hand off to the client, who promotes to PROD through their own change management
• Cadence: two-week sprints; MVP (audit-defensible, may be manual or lean on an existing process) for 7 of 8 controls by 9/25, then hardening to fully operational with evidence by mid-November
• Collaboration: coordinate with client platform (Calvins team), Cloud (network segmentation), and SecOps (dashboards, log-schema ingestion); design gates reviewed by ARB / TRC / SOC before UAT-to-client handoff
• The real floor on speed is the DEV-to-UAT promotion cadence and per-control validation, not coding time. We build with AI coding agents assisting, so mechanical authoring compresses; the validation and sign-off floor does not

What success looks like:-

• 7 of 8 platform controls at a minimally defensible (audit-holds-up) state by 9/25, DC-OBS-9 shortly after
• Each control shipped with the three-artifact trio: control design, documented procedures, and a test plan with evidence including the negative test
• Full McKinsey-built set hardened to fully operational with evidence by mid-November

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.