We turn customer challenges into growth is a global strategy partner to the worlds most recognizable brands and creative companies. Our people around the globe thrive by helping organizations design and deliver rewarding customer experiences.
Srijan a Material company is a renowned global digital engineering firm with a reputation for solving complex technology problems using their deep technology expertise and leveraging strategic partnerships with top-tier technology partners.Be a part of an Awesome Tribe
Must-have skills:-
Azure platform security (primary):-
- Microsoft Entra ID (Azure AD): app registrations service principals OAuth2 scopes delegated vs application permissions On-Behalf-Of (OBO) token flows consent model resource-scoped permissions (Exchange App RBAC RSC-style scoping)
- Azure API Management (APIM): authoring and staging policies per-client policy keyed on client ID correlation-ID handling content-safety and token-limit policies
- Azure networking: NSGs firewall / egress rules private endpoints / private connectivity subnet segmentation
- Azure observability: Azure Monitor diagnostic settings Log Analytics Microsoft Sentinel OpenTelemetry KQL for validation and evidence queries
Engineering and DevOps:-
- Reading and reasoning about application source code to derive least-privilege scope (which MCP servers tools and Graph resources an agent actually calls read vs write target resources). This is the load-bearing skill for DC-IAM-1
- Building a shared instrumentation library / SDK (structured event emission schema conformance mandatory-by-design)
- CI/CD and staged promotion through environments (DEV to UAT) infrastructure-as-config discipline
- Comfort with a native-first GA-only stance: prefer existing generally-available Azure controls over custom code; no preview-tier dependencies
Security engineering practice:
- Default-deny and least-privilege as defaults
- Fail-closed design (a control failure must never become a bypass)
- Proving enforcement with a negative test (the disallowed path is shown to be blocked not just the allowed path working)
- Producing audit-grade evidence: before/after permission exports allow/deny matrices tamper/bypass tests control-design and procedure writeups
Nice to Have:-
- PlainID or another externalized policy decision point (PDP) / policy-based access control
- AI agent platforms LLM gateways MCP (Model Context Protocol) hubs and connectors
- LangSmith or similar LLM tracing tools Postgres (the MCP hub registration / scope model runs on it)
- Prior work in a regulated / financial-services environment and familiarity with control-audit expectations (design gates ARB / TRC / SOC sign-off)
- Guardrail and content-safety tooling (Azure Content Safety Prompt Shields Groundedness)
Working conditions and expectations
- Ground rules: native-first and GA-only; default-deny; fail closed for high-risk; one correlation ID end to end; confirm before changing shared platform config (APIM network identity changes affect every agent so stage in DEV/UAT and validate before handoff)
- Release model: build and stage each control through DEV then UAT complete positive and negative validation and sign-off at UAT then hand off to the client who promotes to PROD through their own change management
- Cadence: two-week sprints; MVP (audit-defensible may be manual or lean on an existing process) for 7 of 8 controls by 9/25 then hardening to fully operational with evidence by mid-November
- Collaboration: coordinate with client platform (Calvins team) Cloud (network segmentation) and SecOps (dashboards log-schema ingestion); design gates reviewed by ARB / TRC / SOC before UAT-to-client handoff
- The real floor on speed is the DEV-to-UAT promotion cadence and per-control validation not coding time. We build with AI coding agents assisting so mechanical authoring compresses; the validation and sign-off floor does not
What success looks like:-
- 7 of 8 platform controls at a minimally defensible (audit-holds-up) state by 9/25 DC-OBS-9 shortly after
- Each control shipped with the three-artifact trio: control design documented procedures and a test plan with evidence including the negative test
- Full McKinsey-built set hardened to fully operational with evidence by mid-November