Senior Azure Security Architect

Join a cloud security engagement supporting the migration of a multi-clinic healthcare organization to Microsoft Azure. As a Senior Azure Security Architect, you will define and oversee the security architecture for a complex hybrid environment, ensuring that clinical and business applications are protected throughout the transformation. You will work across identity, infrastructure, networking, governance, monitoring, and disaster recovery, with a particular focus on ransomware resilience. Collaborating with experienced Azure engineers and a managed security services provider, you will guide technical decisions and strengthen security practices throughout the delivery process. Your expertise will help protect sensitive healthcare information while supporting reliable access to critical clinical systems. This remote, part-time consulting opportunity offers the chance to make a direct impact in a highly regulated healthcare environment.

• Design and own the overall security architecture across Azure identity, infrastructure, networking, governance, access control, logging, and monitoring.

• Review the Azure environment as it is built and provide recommendations to strengthen its security posture.

• Define management group and subscription structures, Azure Policy assignments, security baselines, and written security standards.

• Establish governance practices that support consistent security controls across the environment.

• Ensure that security architecture decisions are clearly documented for technical teams, clients, insurers, and auditors.

• Design Microsoft Entra ID configurations, Conditional Access policies, Privileged Identity Management (PIM), and role-based access control (RBAC).

• Implement least-privilege access principles for administrators, employees, and third-party users.

• Establish secure identity and access practices across cloud and hybrid environments.

• Harden Azure VMware Solution (AVS), Azure virtual machines, and supporting services against recognized security baselines.

• Define network segmentation and traffic-flow controls across Azure ExpressRoute circuits, Palo Alto firewalls, Prisma SD-WAN ION appliances, clinic connections, VPN access, and internet egress.

• Review network architecture and firewall configurations to ensure secure connectivity between cloud, hosted infrastructure, and healthcare applications.

• Support secure integration patterns for vendor-hosted electronic health record (EHR) platforms and connected applications.

• Define logging sources, retention requirements, and security detection coverage using Microsoft Defender for Cloud, Microsoft Sentinel, or the MSSP's monitoring platform.

• Advise on the telemetry required from Azure services and network security infrastructure to support effective threat detection.

• Work with the managed security services provider to evaluate monitoring requests, prioritize relevant security requirements, and refine detection capabilities.

• Design ransomware resilience and recovery strategies, including immutable and isolated backups.

• Define recovery point objectives (RPO), recovery time objectives (RTO), and recovery-testing requirements.

• Support the architecture in which Azure serves as the primary site and the hosted private cloud acts as the secondary recovery environment.

• Map security controls to the HIPAA Security Rule and other relevant cybersecurity frameworks.

• Ensure that security decisions account for regulated healthcare data and applicable Business Associate Agreement (BAA) requirements.

• Participate in technical working sessions with the client and its MSSP.

• Mentor delivery engineers and integrate security best practices into the team's architecture and implementation processes.

The ideal candidate is an experienced Azure security architect with strong hands-on expertise in enterprise cloud environments, hybrid networking, and disaster recovery, ideally within regulated healthcare or similarly demanding industries.

• At least 7 years of experience in information security, including a minimum of 3 years designing and hardening Microsoft Azure environments in production.

• Strong practical knowledge of Azure network security, including hub-and-spoke architecture, Network Security Groups, private endpoints, ExpressRoute, route control, and firewall insertion.

• Experience designing Azure governance frameworks, including management groups, subscriptions, RBAC, Azure Policy, and landing zone security baselines.

• Working knowledge of Microsoft Defender for Cloud, Microsoft Sentinel, or another Security Information and Event Management (SIEM) platform.

• Experience implementing and managing Azure Policy and cloud security controls.

• Practical experience designing backup, recovery, and disaster recovery strategies for ransomware scenarios, including immutable backups and isolated recovery environments.

• Experience working in regulated environments, preferably healthcare, with knowledge of HIPAA requirements and comfort operating under a Business Associate Agreement.

• Professional fluency in English, with the ability to participate in live technical discussions with US-based stakeholders.

• Availability for approximately one to two hours per business day, with scheduling overlap during US Pacific business hours.

• Experience with Palo Alto Networks technologies, particularly VM-Series firewalls and Prisma SD-WAN ION appliances deployed as virtual machines in Azure and hosted environments.

• Experience with Azure VMware Solution, VMware NSX, including distributed firewall micro-segmentation, and VMware HCX.

• Familiarity with Epic or comparable electronic health record platforms and their connectivity and integration security requirements.

• Experience working with or within a managed security services provider (MSSP), including log-source onboarding and alert tuning.

• Knowledge of the NIST Cybersecurity Framework (CSF) 2.0, Microsoft Cloud Security Benchmark, CIS Benchmarks, and HHS 405(d) Health Industry Cybersecurity Practices (HICP).

• Relevant certifications such as Microsoft AZ-500, SC-100, Palo Alto PCNSE, CISSP, CCSP, or HCISPP.

• Spanish language proficiency, in addition to English.

• Strong architectural judgment and the ability to distinguish critical security requirements from lower-priority recommendations.

• Excellent communication and collaboration skills.

• Ability to explain technical risks and recommendations clearly to both engineering teams and business stakeholders.

• A practical, detail-oriented approach to security design, implementation reviews, and documentation.

• Ability to work independently and provide effective guidance within a part-time consulting engagement.