Cube Hub Inc.
Website:
cube-hub.com
Job details:
Title: Azure Cloud Engineer — Entra ID Conditional Access
Location: Remote
Job Type: Contract to Hire
Seasoned cloud engineer for Azure and hybrid deployments, operating as an independent offshore resource. The role assumes minimal supervision, strong governance adherence, and disciplined async communication across time zones.
Identity and access work is the initial focus, but all core Azure competencies below are required and treated as
priority.
Core Azure Technical Skills
Identity & Access
• Entra ID Conditional Access: policy design, report-only → enforcement staging, session controls, token protection
• Phishing-resistant MFA, authentication strength policies, Continuous Access Evaluation
• PIM, access reviews, entitlement management
• Hybrid identity: Entra Connect / Cloud Sync, hybrid join, seamless SSO
• Break-glass account design and CA exclusion handling
Hybrid Infrastructure
• Azure Arc for on-prem server and governance extension
• ExpressRoute / site-to-site connectivity, hybrid DNS across AD/Entra
• Windows Server AD integrated alongside Entra
Core Platform
• VNets, NSGs, private endpoints, Key Vault, backup/DR (ASR)
• Azure Monitor / Log Analytics / KQL
• Cost management and FinOps
Governance & IaC
• Azure Policy, Management Groups, CAF landing zones
• RBAC at scale, tagging standards
• Bicep and/or Terraform with Git-based pipeline deployment
• Defender for Cloud / Secure Score remediation
Soft Skills
• Autonomous execution — delivers from objective with minimal hand-holding; escalates at the right threshold
• Documentation discipline — runbooks and decision logs by default, essential across timezones
• Async communication — complete written updates that don't require a follow-up call
• Best-practice adherence — defaults to Well-Architected / CAF; won't bypass governance for speed
• Change discipline — tests in report-only / non-prod first; understands blast radius
Certifications (Preferred)
• Microsoft SC-300 — validates the Conditional Access priority
• Microsoft AZ-305 (would prefer this)
• Microsoft AZ-104 — baseline
• AZ-500 / SC-100 — security depth
Click on Apply to know more.