Azure Security Manager

Cloud platform architecture & landing zones

• Design Enterprise‑Scale Azure Landing Zones per CAF (management groups, subscription strategy, naming/tagging).
• Engineer guardrails using Azure Policy/initiatives and automate subscription vending with Bicep/Terraform.

Data protection & key management

• Enforce encryption by default; apply CMK for PaaS; govern secrets/certificates with Azure Key Vault.
• Adopt Microsoft Purview‑aligned protection patterns and define DR/backup guardrails for critical data services.

Container & platform hardening

• Define AKS standards (policy for Kubernetes, RBAC, network policies, ACR signing/scanning gates).
• Secure PaaS (App Service, Functions, Storage, SQL, Cosmos DB) with least privilege and network isolation.

Identity & privileged access (Microsoft Entra)

• Establish Conditional Access baselines, authentication strengths, workload identities and B2B collaboration.
• Implement PIM (just‑in‑time), RBAC/ABAC models, break‑glass design and access reviews.

Network & perimeter security

• Architect hub‑and‑spoke or Virtual WAN with zero‑trust segmentation.
• Implement Private Link/Endpoints, Azure Firewall/WAF, DDoS Protection, and NSG/ASG/egress controls.

Posture & compliance (build‑time/run‑time)

• Own Defender for Cloud CSPM enablement and risk‑based remediation (agentless assessments, vuln management).
• Map controls to CIS Azure, Microsoft Cloud Security Benchmark and NIST CSF 2.0; run exceptions/RA processes.

DevSecOps guardrails & automation

• Integrate security in CI/CD: IaC policy checks, code‑to‑cloud mapping and signed artifacts.
• Automate platform changes with Bicep/Terraform, GitOps and change approvals; publish reusable modules.

Collaboration & handover

• Lead multi‑disciplinary teams, coach consultants and communicate design trade‑offs to senior stakeholders.

Impact you’ll make in the first months

• Accelerate secure landing zone rollout with automated subscription vending and policy packages.
• Reduce standing privileges via PIM and staged Conditional Access baselines.
• Improve secure score through prioritized CSPM remediation and IaC‑enforced guardrails.