Azure Cloud and DevOps Architect

Position: Azure Cloud and DevOps Architect

**Position Summary:**We are seeking a hands-on Senior Azure Cloud & DevOps Architect to lead the migration and production deployment of a platform from a local environment to Microsoft Azure.The successful candidate will design, implement, secure, automate, and operationalize the Azure environment using Azure Landing Zone principles, Infrastructure as Code, private networking, managed identities, and Azure DevOps CI/CD pipelines. This is an engineering role requiring direct implementation experience, not only advisory experience.

Experience and Qualifications:

• BE Graduated, approximately 8 -12+ years of cloud, infrastructure, platform, and DevOps engineering experience.
• At least 5 years of substantial Microsoft Azure experience.
• Nice to have Azure Cloud Architect Certification and Azure DevSecOps Certification.

Key Responsibilities:

Mandatory: Required Technical Skills:

• Extensive hands-on experience designing and deploying production workloads on Microsoft Azure.

• Strong expertise in Azure Landing Zone and hub-and-spoke networking.

• Advanced experience with:

• Azure App Service and deployment slots

• Azure Container Apps

• Azure Container Registry

• Azure SQL Database

• Azure Storage

• Azure Key Vault

• Microsoft Entra ID

• Managed identities and Azure RBAC

• Private Link and Private DNS

• Application Insights and Log Analytics

• Azure Monitor and Microsoft Defender

• Advanced Infrastructure-as-Code experience using Bicep and .bicepparam.

• Advanced Azure DevOps YAML pipeline experience.

• Experience with workload identity federation and passwordless Azure deployment.

• Strong Docker and container supply-chain security experience.

• Experience operating ASP.NET Core or .NET applications on Azure.

• Strong understanding of SQL migrations, backward compatibility, backup, and recovery.

• Experience implementing security, quality, approval, and rollback gates in CI/CD.

• Strong PowerShell, Azure CLI, Git, and scripting skills.

• Ability to troubleshoot identity, networking, DNS, certificates, containers, and pipeline failures.

Detailed Responsibilities:

• Azure Cloud Architect and deployment

• Azure App Service for Containers

• Azure Container Apps

• Azure Container Registry

• Azure SQL Database

• Azure Storage and Blob containers

• Azure Key Vault

• Application Insights

• Log Analytics

• Microsoft Defender services

• Private Endpoints and Private DNS

• Azure Networking and Security

• Implement private-by-default Azure architecture

• Configure VNet integration, delegated subnets, private endpoints, Private DNS, route tables, NSGs, and firewall-controlled egress.

• Coordinate connectivity through VPN, ExpressRoute, or Zscaler Private Access.

• Implement Microsoft Entra ID authentication, MFA, managed identities, RBAC, and least privilege.

• Configure Entra-only Azure SQL authentication.

• Protect secrets and encryption keys using Azure Key Vault.

• Implement Defender for Storage malware scanning with fail-closed upload handling.

• Configure Defender for Cloud and Defender for Containers.

• Apply Azure Policy for approved regions, TLS, private access, tags, diagnostics, and container registries.

• Support security reviews using OWASP, Microsoft Cloud Security Benchmark, and applicable organizational controls.

• Data Back-up and Disaster recovery

• Migrate the existing SQL database and governed files into Azure.

• Implement reconciliation, integrity validation, and migration rollback procedures.

• Monitoring and operations

• Configure structured application, platform, security, and audit telemetry.

• Establish separate monitoring identities for web and background-worker workloads.

• Develop dashboards and alerts

• Infrastructure as Code

• Develop and maintain modular Azure Bicep templates.

• Create secure environment-specific .bicepparam files.

• Azure DevOps & CI/CD

• Build and maintain Azure DevOps YAML pipelines for application and infrastructure delivery.

• Implement separate pipelines and permissions for application and infrastructure changes.

• Implement build-once and promote-the-same-artifact principles.

• Build, scan, publish, and deploy immutable container images through ACR.

• Automate:

• Restore, build, and testing

• Database migration generation and execution

• Static security analysis

• Dependency and secret scanning

• Container and IaC scanning

• SBOM generation

• Deployment to staging slots

• Private health and smoke testing

• Slot swap and automatic rollback

• Good Communication skill

• Experience deploying .NET Blazor Server or SignalR applications

• Experience with OpenSearch, Apache Tika, and Gotenberg.

• Experience with private self-hosted Azure DevOps agents.

• Experience with Microsoft Defender for Storage and malware-controlled upload workflows.

• Knowledge of OT/ICS security and compliance environments.

• Familiarity with NERC CIP, IEC 62443, NIST CSF, SOC 2, ISO 27001, or similar frameworks.

• Experience integrating security platforms such as Proofpoint, Check Point, Arctic Wolf, ESET, Zscaler, Horizon3.ai, Bitsight, Zendesk, Microsoft Graph, and MITRE ATT&CK.

• Experience producing SBOMs and using CodeQL, Trivy, Gitleaks, and dependency-scanning tools.

• Azure architecture or DevOps certifications are preferred but not a substitute for hands-on experience

Nice to have Experience:

• You love collaborative environments that use agile methodologies to encourage creative thinking and find innovative ways to develop cutting edge technologies
• Ambitious individual who can work under their own direction towards agreed targets/goals and with creative approach to work
• Intuitive individual with an ability to manage change and proven time management
• Proven interpersonal skills while contributing to team effort by accomplishing related results as needed
• Up-to-date technical knowledge by attending educational workshops, reviewing publications