Cloud Infrastructure and Security Engineer

At Harris, the true value of what makes us successful is found in our people. It is our unique mix of cultures, experiences, beliefs and backgrounds that sets Harris apart from the rest. We constantly strive to cultivate, nurture and amplify an unparalleled environment, where we value intellectual curiosity and uniqueness of thought. Inclusion is embedded in the very fabric of our culture of collaboration and openness. We understand that a job description only tells one part of a broader story, and Harris is seeking dynamic candidates who can add to our best-in-class environment. We recognize that qualifications can be gained through both traditional and non-traditional paths, and we are committed to considering candidates who possess the potential to be excellent in this role regardless of prior experiences. Therefore we encourage ALL interested individuals to submit their applications, even if they do not meet every requirement outlined in the job description. Position Summary InfraSec builds and secures Harris Associates' cloud foundation on Microsoft Azure. The team runs the estate as code - identities, networks, virtual machines, Kubernetes, and data platforms are defined, reviewed, and deployed through automated pipelines rather than managed by hand. It's a lean, hands-on team that partners closely with DevOps, Data, and Application teams, and holds a high bar for security given the firm's regulated environment. The Cloud Infrastructure and Security Engineer is a hands-on, individual-contributor role at the center of this infrastructure-as-code operation, working across environments and cloud regions with deep involvement in identity, networking, compute, and data-platform security. We're looking for an experienced infrastructure or security engineer who thinks in systems, is comfortable owning production-grade cloud environments, and wants the scope to shape how a growing platform is built and secured. Responsibilities may include but are not limited to: • AI-enabled tooling: Build and manage AI/LLM-based skills and agentic workflows that give the team leverage, governed under the same security review and least-privilege discipline as any other credentialed automation, with human review before anything ships. • Patching and on-call: Share the team's operational rotations — patch the estate roughly three to four Saturdays a year, and serve as on-call first responder for infrastructure and security issues about one week a month, resolving directly or escalating as needed. • Infrastructure as code: Author and maintain Terraform across roughly 18 repositories, multiple environments and regions, with Azure Storage state backends — holding the line on version/provider discipline, import safety, and plan-diff review. • Identity and access management: Provision and govern Microsoft Entra ID — app-role and role-assignable groups, PIM/JIT, Conditional Access, Workload Identity Federation, and Microsoft Graph — designing least-privilege grants and auditing existing ones. • Cloud networking: Design and operate hub-and-spoke topology, management-group policy and custom roles, NSG/firewall rules, routing, and trusted network locations, and troubleshoot when it breaks. • Virtual machines and golden images: Provision hardened Azure VMs from a shared module (secure boot, vTPM, encryption at host, Hybrid Benefit), and build/maintain golden Windows Server images with Packer. • Kubernetes and containers: Support the AKS platform alongside DevOps — workload identity, service-mesh and egress behavior, and connectivity troubleshooting. • Data and analytics platform access: Govern access and security settings for Databricks, Snowflake, Power BI/Microsoft Fabric, and Purview, and manage platform-level governance. • Monitoring and inc