Technical Expertise
1. Azure Fundamentals
o Proficient with Azure Resource Manager (ARM), Azure Policy, Azure Security Center, and Azure Monitor.
o Experience in creating and managing Azure resources (VMs, networks, storage, identity, etc.).
2. Security and Compliance
o Strong understanding of SOC 2 and HITRUST compliance requirements.
o Experience with implementing Azure policies for regulatory compliance.
o Familiarity with Azure Blueprints for compliance frameworks.
3. Identity and Access Management (IAM)
o Managing Azure Active Directory (AAD), role-based access control (RBAC), and Privileged Identity Management (PIM).
4. Risk Assessment and Mitigation
o Knowledge of Azure Security Center to monitor threats and vulnerabilities.
o Proficiency in threat modelling and risk assessment specific to cloud resources.
5. Monitoring and Auditing
o Setting up and managing logging and monitoring tools like Azure Monitor, Log Analytics, and Sentinel.
o Implementing audit trails to ensure compliance and track resource usage.
6. Infrastructure as Code (IaC)
o Experience with IaC tools like Azure Bicep, Terraform, or ARM templates for automated resource deployment.
Certifications
• Azure Certifications
o Microsoft Certified: Azure Security Engineer Associate
o Microsoft Certified: Azure Administrator Associate
o Microsoft Certified: Azure Solutions Architect Expert (optional but valuable)
• Compliance Certifications
o Certified Information Systems Auditor (CISA)
o Certified Information Systems Security Professional (CISSP)
o Certified Cloud Security Professional (CCSP)
________________________________________
Nice-to-Have Skills
These enhance the effectiveness of the candidate but are not strictly necessary:
1. DevOps Integration
o Experience with CI/CD pipelines and integrating security into DevOps workflows (DevSecOps).
2. Automation and Scripting
o Proficiency in scripting languages (e.g., PowerShell, Python) for automating compliance checks and tasks.
3. Networking Expertise
o Deep understanding of Azure networking (e.g., VNet, NSG, Azure Firewall, VPN Gateway).
4. Data Security
o Knowledge of Azure data protection tools, including encryption (at rest and in transit) and Key Vault.
5. Audit Experience
o Experience working directly with auditors to ensure compliance with SOC 2 or HITRUST.
6. Cross-Cloud Knowledge
o Familiarity with other cloud platforms (AWS, GCP) to provide perspective on multi-cloud compliance if needed.
7. Project Management
o Ability to manage and coordinate compliance-related projects, ideally with knowledge of agile methodologies.
________________________________________
Key Responsibilities
The person in this role will:
1. Implement and manage Azure policies and resources to meet SOC 2 and HITRUST standards.
2. Perform regular audits and vulnerability assessments.
3. Develop and maintain documentation to support compliance efforts.
4. Monitor Azure environments for security threats and non-compliance.
5. Collaborate with internal teams to address compliance gaps and implement best practices.
