Technical Lead - DevOps & Security
First seen by Alion on Oct 27, 2026.
About the Role:
Srijan, a Material company, is a global digital engineering firm specialising in solving complex technology challenges. We are seeking a Technical Lead DevOps & Security with strong expertise in Azure platform security, identity and access management, API security, cloud networking, observability, and DevOps engineering.
Responsibilities:
- Design and implement Azure platform security controls using Microsoft Entra ID, Azure API Management (APIM), Azure networking, and native Azure monitoring and security services.
- Configure Microsoft Entra ID app registrations, service principals, OAuth 2.0 scopes, delegated and application permissions, OBO token flows, and consent models.
- Implement resource-scoped permissions, including Exchange Application RBAC and resource-specific consent (RSC)-style scoping.
- Develop and stage APIM policies, including client-specific policies, correlation-ID propagation, content-safety controls, and token-limit enforcement.
- Configure network security groups, firewall and egress rules, private endpoints, private connectivity, and subnet segmentation.
- Implement observability and audit logging using Azure Monitor, Log Analytics, Microsoft Sentinel, OpenTelemetry, and KQL.
- Review application source code and agent workflows to determine minimum permissions for MCP servers, tools, and Microsoft Graph resources.
- Build shared instrumentation libraries or SDKs that enforce structured event emission, schema compliance, and consistent logging.
- Implement CI/CD pipelines and infrastructure-as-code practices to promote controls through DEV and UAT environments.
- Follow a native-first, GA-only approach, prioritising existing Azure security capabilities.
- Apply default-deny, least-privilege, and fail-closed principles to prevent unauthorised access.
- Design and execute positive and negative security tests to verify permitted operations and block unauthorised access.
- Produce audit-ready evidence, including permission exports, allow/deny matrices, tamper tests, and control designs.
- Coordinate with client platform, cloud networking, and SecOps teams to implement network segmentation and security dashboards.
- Manage control implementation through two-week sprint cycles, ensuring staged promotion and validation.
- Collaborate with architecture and governance stakeholders to support ARB, TRC, and security/compliance sign-offs.
- Drive continuous hardening of platform controls, ensuring they are operationally effective and verifiable.
Requirements :
- 6 - 10 years of experience in DevOps engineering, cloud security, platform engineering, or security engineering, with strong hands-on expertise in Microsoft Azure.
- Strong knowledge of Microsoft Entra ID, including app registrations, service principals, OAuth 2.0, and consent management.
- Hands-on experience with Azure API Management, policy authoring, and security policy enforcement.
- Strong understanding of Azure networking (NSGs, firewalls, egress controls, private endpoints, subnet segmentation).
- Experience with Azure Monitor, Log Analytics, Microsoft Sentinel, OpenTelemetry, and KQL.
- Ability to analyse source code and derive least-privilege permissions for AI agents, MCP servers, and Microsoft Graph resources.
- Experience developing shared instrumentation libraries, structured logging, and telemetry controls.
- Strong understanding of CI/CD pipelines, infrastructure as code, and controlled promotion across environments.
- Practical experience with default-deny access, fail-closed controls, and security bypass validation.
- Ability to produce clear technical documentation, control designs, and audit-grade evidence.
- Strong collaboration and stakeholder management skills.
- Ability to work in an Agile environment and deliver security controls within defined timelines.
- Experience with PlainID, AI agent platforms, LLM gateways, MCP hubs, LangSmith, PostgreSQL, and Azure AI security (Content Safety, Prompt Shields) would be an advantage.
Working Conditions :
- The role follows a native-first, GA-only approach with staged DEV-to-UAT promotion, positive and negative testing, and documented sign-off before client handover. Production changes are managed by the client through its own change-control process.
Skills
DevOps, DevSecOps, IT Security Strategy, Security Protocols, Azure, Cloud Security, Configuration Management, Entra ID, Security Monitoring Tools, CI/CD Pipeline