Material - Technical Lead - DevOps Andamp; Security

About The Role

Srijan, a Material company, is a global digital engineering firm specialising in solving complex technology challenges. We are seeking a Technical Lead DevOps & Security with strong expertise in Azure platform security, identity and access management, API security, cloud networking, observability, and DevOps Design and implement Azure platform security controls using Microsoft Entra ID, Azure API Management (APIM), Azure networking, and native Azure monitoring and security services.

• Configure Microsoft Entra ID app registrations, service principals, OAuth 2.0 scopes, delegated and application permissions, OBO token flows, and consent models.
• Implement resource-scoped permissions, including Exchange Application RBAC and resource-specific consent (RSC)-style scoping.
• Develop and stage APIM policies, including client-specific policies, correlation-ID propagation, content-safety controls, and token-limit enforcement.
• Configure network security groups, firewall and egress rules, private endpoints, private connectivity, and subnet segmentation.
• Implement observability and audit logging using Azure Monitor, Log Analytics, Microsoft Sentinel, OpenTelemetry, and KQL.
• Review application source code and agent workflows to determine minimum permissions for MCP servers, tools, and Microsoft Graph resources.
• Build shared instrumentation libraries or SDKs that enforce structured event emission, schema compliance, and consistent logging.
• Implement CI/CD pipelines and infrastructure-as-code practices to promote controls through DEV and UAT environments.
• Follow a native-first, GA-only approach, prioritising existing Azure security capabilities.
• Apply default-deny, least-privilege, and fail-closed principles to prevent unauthorised access.
• Design and execute positive and negative security tests to verify permitted operations and block unauthorised access.
• Produce audit-ready evidence, including permission exports, allow/deny matrices, tamper tests, and control designs.
• Coordinate with client platform, cloud networking, and SecOps teams to implement network segmentation and security dashboards.
• Manage control implementation through two-week sprint cycles, ensuring staged promotion and validation.
• Collaborate with architecture and governance stakeholders to support ARB, TRC, and security/compliance sign-offs.
• Drive continuous hardening of platform controls, ensuring they are operationally effective and verifiable.
  
  

• 6 - 10 years of experience in DevOps engineering, cloud security, platform engineering, or security engineering, with strong hands-on expertise in Microsoft Azure.
• Strong knowledge of Microsoft Entra ID, including app registrations, service principals, OAuth 2.0, and consent management.
• Hands-on experience with Azure API Management, policy authoring, and security policy enforcement.
• Strong understanding of Azure networking (NSGs, firewalls, egress controls, private endpoints, subnet segmentation).
• Experience with Azure Monitor, Log Analytics, Microsoft Sentinel, OpenTelemetry, and KQL.
• Ability to analyse source code and derive least-privilege permissions for AI agents, MCP servers, and Microsoft Graph resources.
• Experience developing shared instrumentation libraries, structured logging, and telemetry controls.
• Strong understanding of CI/CD pipelines, infrastructure as code, and controlled promotion across environments.
• Practical experience with default-deny access, fail-closed controls, and security bypass validation.
• Ability to produce clear technical documentation, control designs, and audit-grade evidence.
• Strong collaboration and stakeholder management skills.
• Ability to work in an Agile environment and deliver security controls within defined timelines.
• Experience with PlainID, AI agent platforms, LLM gateways, MCP hubs, LangSmith, PostgreSQL, and Azure AI security (Content Safety, Prompt Shields) would be an advantage.
  
  

• The role follows a native-first, GA-only approach with staged DEV-to-UAT promotion, positive and negative testing, and documented sign-off before client handover. Production changes are managed by the client through its own change-control process.