{"id":4034657,"url":"https://alion.io/job/cfgi-networkcloud-infrastructure-security-engineer","title":"Network/Cloud Infrastructure Security Engineer","company":{"id":672933,"name":"CFGI","domain":"cfgi.com","url":"https://alion.io/company/cfgi","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"B","score":74,"open_postings":78,"ghost_share":0.346,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":352,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bicep","optional":false},{"name":"CI/CD","optional":false},{"name":"CIS Benchmarks","optional":false},{"name":"DLP","optional":false},{"name":"Git","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Jira","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linear","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"NIST CSF","optional":false},{"name":"OneDrive","optional":false},{"name":"Power Automate","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"Service Desk","optional":false},{"name":"SharePoint","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Zscaler","optional":false}],"status":"live","first_seen_at":"2026-11-10T16:18:24Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T19:45:57Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Position Overview\nCFGI is seeking a full-time Network/Cloud Infrastructure Security Engineer to join its corporate Information Technology department, reporting to the Director of Information Technology. This hands-on role owns the identity, access, and cloud foundations behind more than 1,400 users across domestic and international offices, including Microsoft Entra ID, Azure, GitHub, Linear, Jira, and other business-critical applications.\nAs a professional services firm entrusted with sensitive client financial data, CFGI must meet the security expectations of public companies, private equity sponsors, and auditors, and this role turns those expectations into practical, well-documented controls. The engineer is the primary resource for Identity and Access Management (“IAM”) and infrastructure requests from product development, an escalation point for the IT team, and a partner to IT Service Management and functions across the firm.\nCore Responsibilities\nCloud Infrastructure and Architecture\nDesign, build, and maintain secure Azure environments, including landing zones, subscription structure, networking, and resource governance.\nImplement and manage infrastructure as code (Terraform, Bicep) and Azure Policy to keep cloud environments consistent, governed, and auditable.\nPlan and execute tenant, domain, and workload migrations, including Microsoft 365 tenant-to-tenant moves related to acquisitions and expansion.\nMaintain backup and disaster recovery for critical systems, and plan for future multi-cloud expansion, such as AWS.\nIdentity and Access Management\nAdminister and improve Microsoft Entra ID, including Conditional Access, MFA and passwordless authentication, identity protection, and least-privilege RBAC across Azure and Microsoft 365.\nCreate and manage Entra ID enterprise applications and app registrations, including SAML/OIDC SSO, SCIM provisioning, API permissions and admin consent, app owners, and certificate and secret expiration.\nManage identity and access for GitHub, Linear, and Jira, including Entra ID SSO, SCIM provisioning, team and project permissions, access reviews, and timely offboarding.\nEnforce GitHub security best practices, including branch protection, required reviews, secret scanning, OIDC federation from GitHub Actions to Azure, and audit log streaming to Microsoft Sentinel.\nServe as the primary contact for IAM requests from product development and an escalation point for the IT team on infrastructure and IAM tickets, tracked through Zoho ServiceDesk.\nManage guest and external access for client collaboration in Teams and SharePoint, balancing productivity with confidentiality.\nSecurity and Data Protection\nDesign and improve security controls across Microsoft Defender and Defender for Cloud, and remediate posture findings using Microsoft Secure Score and CIS Benchmarks.\nManage Microsoft Sentinel data connectors and detection rules, and lead incident response for cloud and identity threats alongside the Director of IT and the firm’s managed 24/7 SOC provider.\nSecure email, web, and SaaS access through Exchange Online, Mimecast, and Zscaler policy design.\nCreate and manage Azure Key Vaults, including RBAC-based access, managed identity integration, and rotation and expiration monitoring for secrets, certificates, and keys.\nDesign SharePoint and OneDrive permissions, Multi-Geo data residency, and Microsoft Purview sensitivity labels, DLP, and retention policies.\nAutomation and Integration\nAutomate administrative and security tasks using PowerShell, Microsoft Graph, Python, and the Azure CLI.\nBuild workflow automations with Power Automate, Logic Apps, and REST APIs across IT and business platforms.\nEnsure AI tools and integrations meet CFGI’s identity, data, and security standards.\nCompliance and Client Assurance\nProvide architecture documentation and technical evidence for SOC 2, ISO 27001, and client-driven security reviews.\nSupport responses to client security questionnaires and due diligence requests on cloud, identity, and data protection controls.\nEvaluate the security of new vendors and SaaS applications before they are connected to CFGI’s identity provider or data.\nDocumentation and Knowledge Transfer\nMaintain architecture diagrams, standards, runbooks, and change records, following change management practices for all environments this role owns.\nTrain IT Specialists on identity, Intune, and cloud administration.\nQualifications\nWhat you must have\n5+ years of experience in cloud infrastructure, systems engineering, identity, or security engineering.\nExperience administering and engineering Microsoft 365 and Azure environments, including at least 2 years of hands-on experience.\nWorking knowledge of information security control frameworks.\nWhat sets you apart\nExperience engineering identity and access controls, including conditional access, multifactor authentication, privileged identity management, role-based access, enterprise application integration, and hybrid identity.\nExperience administering cloud infrastructure, including networking, compute, storage, and resource governance.\nExperience administering source-code hosting organizations, including single sign-on, automated provisioning, team-based permissions, branch protection, secret scanning, and secure credential handling for CI/CD workflows.\nProficiency in administrative scripting and API-based automation.\nExperience with infrastructure as code and version control.\nExperience with Microsoft Entra ID, including enterprise applications, app registrations, Active Directory, and Entra Connect / Cloud Sync.\nExperience administering GitHub organizations and securing GitHub Actions.\nProficiency with PowerShell and Microsoft Graph.\nExperience with Terraform, Bicep, or ARM, and Git.\nWorking knowledge of frameworks such as CIS, NIST CSF, SOC 2, or ISO 27001.\nBachelor’s degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent professional experience.\nNice to have\nCertifications such as Microsoft SC-300, AZ-104, AZ-500, AZ-305, GitHub Administration, or AWS Solutions Architect - Associate.\nWorking knowledge of AWS, including IAM, IAM Identity Center federation with Entra ID, AWS Organizations, and core security services such as CloudTrail, GuardDuty, and Security Hub.\nExperience administering Jira, including Atlassian Guard, or Linear.\nExperience in professional services, accounting, or financial services, including supporting client audits and security questionnaires.\nAdditional Information\nLocation\nPrimarily remote, with in-person work when required.\nEastern Time Zone, in the Northeast or Southeast US.\nOccasional travel for projects or company events.","description_format":"text","description_chars":6696,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Company events","Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Advisory, Valuation & Restructuring","Accounting & Bookkeeping Services","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-11-10T19:45:57Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-11-10T11:34:35+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":352,"reasons":["conf:1","win:early"],"computed_at":"2026-11-10T21:07:36Z"},"pay":null,"html_url":"https://alion.io/job/cfgi-networkcloud-infrastructure-security-engineer","json_url":"https://alion.io/job/cfgi-networkcloud-infrastructure-security-engineer.json","meta":{"generated_at":"2026-11-10T21:07:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14462,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":672933},"rest":"https://alion.io/mcp/rest/get_company?id=672933"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcfgi-networkcloud-infrastructure-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcfgi-networkcloud-infrastructure-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcfgi-networkcloud-infrastructure-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cfgi-networkcloud-infrastructure-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcfgi-networkcloud-infrastructure-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4034657}},{"tool":"search_jobs","arguments":{"company":"cfgi.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4034657},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}