Senior Cloud Systems Engineer

At MoFo, we couldn’t write our own success story without yours. Ready to write your story? Join MoFo as a Senior Cloud Systems Engineer on our Information Technology team! This role can be based in San Francisco, Palo Alto, Los Angeles, San Diego, Austin, New York, Boston or Washington D.C.

The Senior Cloud Systems Engineer is responsible for the architecture, engineering, security, and operation of the Firm’s Microsoft Azure environment and Microsoft Entra identity platform. This individual will serve as a senior technical authority for Azure landing zones, governance, networking, and resiliency, and for Microsoft Entra  and access management, including Conditional Access, authentication, privileged access, and application integration. They will manage cloud endpoint and virtual desktop services, including Microsoft Intune and Azure Virtual Desktop.

They will lead cloud infrastructure projects from conception through Firm‑wide deployment, automating build and operations through infrastructure as code and scripting.

• Architects and maintains the Firm’s Microsoft Azure environment, including landing zones, management group hierarchy, and subscription design, in alignment with the Cloud Adoption and Well-Architected Frameworks.
• Establishes and enforces cloud governance through Azure Policy, role-based access control (RBAC), and naming and tagging standards; remediates non-compliance across all subscriptions.
• Designs, builds, and supports Azure infrastructure and platform services, including virtual machines and scale sets, App Service, Azure SQL, Azure Storage, and Key Vault.
• Engineers Azure networking, including hub-and-spoke topology, network security groups, private endpoints, Private DNS, VPN Gateway and Express Route, and Azure Front Door with Web Application Firewall.
• Builds and maintains hardened, standardized virtual machine images with Azure VM Image Builder and Azure Compute Gallery; keeps Azure-hosted servers patched through Azure Update Manager.
• Designs for resiliency using availability zones, paired regions, Azure Backup, and Azure Site Recovery; performs backup, restore, data migration, and disaster recovery testing.
• In partnership with Information Security, implements cloud security controls, including Microsoft Defender for Cloud, managed identities, Key Vault, and least-privilege access, and remediates findings.
• Monitors platform health, performance, capacity, and cost using Azure Monitor, Log Analytics, and Azure Cost Management; supports the Firm’s Cloud Fin Ops practice through rightsizing, reservations, and cost allocation.
• Develops infrastructure as code (Bicep, ARM, and/or Terraform) and Power Shell automation using Azure Resource Manager and Microsoft Graph REST APIs, delivering repeatable, self-service deployment patterns within governance guardrails.

• Serves as senior administrator and subject matter expert for the Firm’s Microsoft Entra t, including identity architecture, tenant configuration, and least-privilege delegated administration.
• In partnership with Information Security, designs and maintains Conditional Access policies, including authentication strengths, device compliance, and Continuous Access Evaluation; validates changes in report-only mode before enforcement.
• Leads the Firm’s adoption of phishing-resistant and passwordless authentication, including Microsoft Authenticator, passkeys (FIDO2), Windows Hello for Business, and certificate-based authentication.
• Administers Privileged Identity Management (PIM) for just-in-time access to Entra and Azure roles, and maintains emergency access accounts.
• Integrates applications with Entra  SAML, OpenID Connect, and…