Azure Cloud Engineer — Entra ID Conditional Access

Title: Azure Cloud Engineer — Entra ID Conditional Access

Location: Remote

Job Type: Contract to Hire

Seasoned cloud engineer for Azure and hybrid deployments, operating as an independent offshore resource. The role assumes minimal supervision, strong governance adherence, and disciplined async communication across time zones.

Identity and access work is the initial focus, but all core Azure competencies below are required and treated as

priority.

Core Azure Technical Skills

Identity & Access

• Entra ID Conditional Access: policy design, report-only → enforcement staging, session controls, token protection

• Phishing-resistant MFA, authentication strength policies, Continuous Access Evaluation

• PIM, access reviews, entitlement management

• Hybrid identity: Entra Connect / Cloud Sync, hybrid join, seamless SSO

• Break-glass account design and CA exclusion handling

Hybrid Infrastructure

• Azure Arc for on-prem server and governance extension

• ExpressRoute / site-to-site connectivity, hybrid DNS across AD/Entra

• Windows Server AD integrated alongside Entra

Core Platform

• VNets, NSGs, private endpoints, Key Vault, backup/DR (ASR)

• Azure Monitor / Log Analytics / KQL

• Cost management and FinOps

Governance & IaC

• Azure Policy, Management Groups, CAF landing zones

• RBAC at scale, tagging standards

• Bicep and/or Terraform with Git-based pipeline deployment

• Defender for Cloud / Secure Score remediation

Soft Skills

• Autonomous execution — delivers from objective with minimal hand-holding; escalates at the right threshold

• Documentation discipline — runbooks and decision logs by default, essential across timezones

• Async communication — complete written updates that don’t require a follow-up call

• Best-practice adherence — defaults to Well-Architected / CAF; won’t bypass governance for speed

• Change discipline — tests in report-only / non-prod first; understands blast radius

Certifications (Preferred)

• Microsoft SC-300 — validates the Conditional Access priority

• Microsoft AZ-305 (would prefer this)

• Microsoft AZ-104 — baseline

• AZ-500 / SC-100 — security depth