Security / Zero Trust Architect (Azure & Microsoft Fabric)
Security / Zero Trust Architect (Azure & Microsoft Fabric) Engagement Zero Trust Architecture infrastructure for a Microsoft Fabric estate at a federal credit union, supporting a Tableau-to-Power BI/Fabric migration Seniority Architect Engagement context migrating ~120 Tableau reports to Power BI/Fabric, with a Snowflake enterprise data warehouse. Zero Trust is a client requirement, and every infrastructure change goes through the client’s Architecture Review Board (ARB) and Change Advisory Board (CAB). The Foundation Phase designs are already approved; this role implements and evidences them. What this person will do Confirm the Zero Trust control baseline, required evidence per control, and the client owner for each control domain. Identity & access: Entra ID group, persona, and administrative role structures; conditional access, MFA, and device/session controls for Fabric and Power BI; privileged access with just-in-time elevation and separation of duties; service principal, managed identity, and secret management patterns. Data protection: Microsoft Purview sensitivity labeling and information protection for Fabric/Power BI content; encryption, key management, and data residency alignment. Tenant hardening: Fabric tenant settings, sharing/export controls, and external access restrictions. Auditability: Audit logging, activity monitoring, and retention configuration. Run a Microsoft Defender for Cloud security posture (CSPM) assessment with attack path analysis. Execute control validation and capture supporting evidence; prepare change documentation for ARB/CAB. Must-have experience Azure security architecture in regulated financial services (banking, credit unions, or similar). Entra ID conditional access, PIM/JIT, service identities, and workload identity security. Microsoft Purview information protection and sensitivity labels applied to Power BI/Fabric. Power BI/Fabric tenant security settings. Defender for Cloud CSPM; experience producing control evidence for auditors or regulators. Strongly preferred NCUA/FFIEC familiarity; Snowflake security integration; SC-100, AZ-500, SC-300 certifications.