Senior Security Architecture Consultant - 100% Remote - 6 Months Contract

Job Details:

Job Title:             Senior Security Architecture Consultant

Location:             100% Remote

Duration:            6 Months Contract

Skillset Needed: Azure, IaC, Defender for Cloud, Azure networking, Terraform

Overview: Client is looking for an experienced security architecture consultant for a six-month engagement. The consultant will establish the foundation of our security architecture practice, build an initial library of secure design patterns, and assess and improve how we handle secure configuration and hardening in Microsoft Azure. We want a hands-on practitioner who can both set strategy and produce practical, reusable artifacts our internal team will own after the engagement.

Objectives and Scope:

• Establish the security architecture practice - define the practice's mission, scope, operating model, and how it engages with infrastructure, application, cloud, and project teams. Create a security architecture review process, including intake criteria, review checkpoints in the delivery lifecycle, and decision and exception handling. Develop core governance artifacts: architecture principles, reference standards, templates (design review template, threat model template, decision record), and a RACI. Recommend practice roles, skills, and a staffing model, plus a 12-18 month roadmap for maturing the practice after the engagement.
• Build an initial library of secure patterns - identify highest-priority patterns based on current and planned workloads (identity and access, network segmentation and connectivity, secrets and key management, data protection, logging and monitoring, PaaS service integration, application hosting). Document each pattern with context, reference architecture diagram, required security controls, configuration guidance, and alignment to relevant frameworks. Set up a structure and process to keep the library maintained and growing after the engagement.
• Assess and improve Azure secure configuration and hardening - review the current Azure environment and practices, including landing zone and subscription design, Azure Policy use, Defender for Cloud posture, identity configuration in Entra ID, network controls, and infrastructure deployment (manual vs. infrastructure-as-code). Benchmark against the Microsoft Cloud Security Benchmark, CIS Azure Foundations Benchmark, the security pillar of the Azure Well-Architected Framework, and the Cloud Adoption Framework. Deliver a gap assessment with prioritized recommendations covering baseline definitions, policy-as-code, guardrails in deployment pipelines, drift detection, exception management, and ongoing posture monitoring. Provide a phased remediation and improvement roadmap with effort estimates.

Expected Deliverables: Security architecture practice charter, operating model, and review process; architecture principles, standards, and templates; initial secure pattern library; Azure secure configuration and hardening assessment report; prioritized recommendations and remediation roadmap; practice maturity roadmap; knowledge transfer sessions throughout the engagement, and a final handoff.

Suggested Timeline: Month 1: Discovery, stakeholder interviews, current-state Azure review. Months 2-3: Practice foundation and governance artifacts; Azure assessment findings. Months 3-5: Pattern library development; hardening recommendations and roadmap. Month 6: Refinement, knowledge transfer, and transition to internal ownership.

Required Qualifications: 10+ years in information security, with at least 5 years in a security architecture role. Demonstrated experience standing up or maturing a security architecture function, not only performing reviews. Deep, hands-on Azure security expertise, including Azure Policy, Defender for Cloud, Entra ID, Azure networking, Key Vault, and landing zone design. Working knowledge of infrastructure-as-code (Bicep and/or Terraform) and policy-as-code approaches. Familiarity with frameworks such as NIST CSF, NIST 800-53, CIS Controls, and Zero Trust architecture models. (Note: the qualifications list in the source email appears cut off mid-sentence after "Strong written communication...")