About US:- We turn customer challenges into growth opportunities. Material is a global strategy partner to the world’s most recognizable brands and innovative companies. Our people around the globe thrive by helping organizations design and deliver rewarding customer experiences. Srijan, a Material company, is a renowned global digital engineering firm with a reputation for solving complex technology problems using their deep technology expertise and leveraging strategic partnerships with top-tier technology partners. Be a part of an Awesome Tribe

Must-have skills:-

Azure platform security (primary):-

- Microsoft Entra ID (Azure AD): app registrations, service principals, OAuth2 scopes, delegated vs application permissions, On-Behalf-Of (OBO) token flows, consent model, resource-scoped permissions (Exchange App RBAC, RSC-style scoping)
- Azure API Management (APIM): authoring and staging policies, per-client policy keyed on client ID, correlation-ID handling, content-safety and token-limit policies
- Azure networking: NSGs, firewall / egress rules, private endpoints / private connectivity, subnet segmentation
- Azure observability: Azure Monitor diagnostic settings, Log Analytics, Microsoft Sentinel, OpenTelemetry, KQL for validation and evidence queries

Engineering and DevOps:-

- Reading and reasoning about application source code to derive least-privilege scope (which MCP servers, tools, and Graph resources an agent actually calls, read vs write, target resources). This is the load-bearing skill for DC-IAM-1
- Building a shared instrumentation library / SDK (structured event emission, schema conformance,



mandatory-by-design)
- CI/CD and staged promotion through environments (DEV to UAT), infrastructure-as-config discipline
- Comfort with a native-first, GA-only stance: prefer existing generally-available Azure controls over custom code; no preview-tier dependencies

Security engineering practice:

- Default-deny and least-privilege as defaults
- Fail-closed design (a control failure must never become a bypass)
- Proving enforcement with a negative test (the disallowed path is shown to be blocked, not just the allowed path working)
- Producing audit-grade evidence: before/after permission exports, allow/deny matrices, tamper/bypass tests, control-design and procedure writeups

Nice to Have:-

- PlainID or another externalized policy decision point (PDP) / policy-based access control
- AI agent platforms, LLM gateways, MCP (Model Context Protocol) hubs and connectors
- LangSmith or similar LLM tracing tools Postgres (the MCP hub registration / scope model runs on it)
- Prior work in a regulated / financial-services workplace and familiarity with control-audit expectations (design gates, ARB / TRC / SOC sign-off)
- Guardrail and content-safety tooling (Azure Content Safety, Prompt Shields, Groundedness)





Working conditions and expectations

- Ground rules: native-first and GA-only; default-deny; fail closed for high-risk; one correlation ID end to end; confirm before changing shared platform config (APIM, network, identity changes affect every agent, so stage in DEV/UAT and validate before handoff)
- Release model: build and stage each control through DEV then UAT, complete positive and negative validation and sign-off at UAT, then hand off to the client, who promotes to PROD through their own change management
- Cadence: two-week sprints; MVP (audit-defensible, may be manual or lean on an existing process) for 7 of 8 controls by 9/25, then hardening to fully operational with evidence by mid-November
- Collaboration: coordinate with client platform (Calvin's team), Cloud (network segmentation), and SecOps (dashboards, log-schema ingestion); design gates reviewed by ARB / TRC / SOC before UAT-to-client handoff
- The real floor on speed is the DEV-to-UAT promotion cadence and per-control validation, not coding time. We build with AI coding agents assisting, so mechanical authoring compresses; the validation and sign-off floor does not

What success looks like:-

- 7 of 8 platform controls at a minimally defensible (audit-holds-up) state by 9/25, DC-OBS-9 shortly after
- Each control shipped with the three-artifact trio: control design, documented procedures, and a test plan with evidence including the negative test
- Full McKinsey-built set hardened to fully operational with evidence by mid-November

📌 Technical Lead DevOps & Security (Gurugram)
🏢 SRIJAN TECHNOLOGIES
📍 Gurugram