Solution Architect . Azure Virtual Desktop

Role & responsibilities

Solution Architect Azure Virtual Desktop

Location Offshore

Experience Required

8+ years cloud infrastructure; 5+ years AVD

Band Solution Architect

Certifications

Azure Solutions Architect Expert (required); AVD Specialty (required)

=====================================================================

1. Solution Design & Architecture

* Own end-to-end AVD solution design for every new deployment: subscription architecture, host pool design, VNet/subnet topology, NSG strategy, storage design, and FS Logix configuration.

* Design dedicated AVD subscriptions (standard model) and manage exceptions where agency subscription deployment is justified by proven sub-millisecond latency requirements

* Produce the AVD Solution Design Document (SDD) using the standard 70-page design document template for every deployment; the SDD must be agency-signed before the Cloud Object Build

* Define host pool type

* Define and enforce the two-environment mandatory deployment sequence: non-prod 2-node minimum first, UAT sign-off obtained, then production deployment authorized.

2. Requirements Gathering & Agency Engagement

* Conduct discovery and requirements calls with agency stakeholders for every new AVD request;

* RemoteApp delivery model, non-prod and prod requirements, network connectivity requirements, and storage requirements.

* Define the Remote App vs full desktop delivery model during solutioning and document the decision in the SDD; always set Preferred App Group Type to Desktop regardless of delivery model due to Windows App client requirements.

3. Build Coordination & RITM Governance

* Initiate and own New Cloud Presence and New Cloud Object RITMs in ServiceNow; ensure to follow standard

* Coordinate all parallel build workstreams and manage critical path dependencies

* Track RITM progress daily; resolve blockers across Modern Workplace, WAN, Endpoint, and agency teams within build SLAs.

* Conduct post-build validation review: confirm FS Logix profile mount, Intune registration, AVD Insights data flow, storage FQDN private endpoint DNS resolution

* Finalize the as-built SDD after UAT pass; upload to the SA team SharePoint site; update the Deployment Summary spreadsheet; validate CMDB CI closure.

4. Security Architecture & Compliance

* Design and enforce the Zero Trust Network Access (ZTNA) model for all AVD host pool subnets: explicit deny-all inbound (Rule 4096), explicit deny-all outbound (Rule 4096) with named Microsoft service tag allowances only.

* Ensure the security controls are implemented on every deployment

* Review NSG rule sets quarterly; challenge inbound RDP 3389 rules from ODC AVD, intra-host-pool, and NPA ranges; document business justification or raise removal requests to the WAN team.

* Compliance scope: ISO 27001, ODCCS cloud security standards, DSO endpoint security standards, ZTNA NFR.

5. Image Management & Application Strategy

* Define the image strategy for each deployment: Microsoft Marketplace Windows 11 Enterprise Multi-Session 24H2 or 25H2 (default) vs custom golden image via Azure Compute Gallery (exception).

* Coordinate image refresh cycles with the Endpoint team; raise Cloud Service General Request tickets in ServiceNow specifying gallery image name and version for session host redeployment.

Own the image refresh redeployment process: 1 session host pilot first, UAT, then remaining hosts; original hosts in drain mode; rollback by deleting new hosts and re-enabling drain mode on originals.

* Define the application delivery model per agency: Intune (standard Marketplace image deployments), Gold Image, or manual SCCM packaging; approve all packaging exceptions in the SDD.

* Manage application packaging SLA coordination with the Endpoint team: simple 2-3 days, medium 2-3 weeks, complex 1+ month; escalate SLA breaches that impact build delivery.

6. Cost Estimation & Financial Governance

* Produce AVD cost estimates using the Azure Pricing Calculator and the internal AVD cost model accounting for Omnicom EA discounts, reserved instance coverage, and scaling plan utilization reduction.

* Present cost estimates using the standard RITM naming format (RITMxxx-who-what-where) for all ServiceNow financial approval submissions.

* Apply the shared services chargeback model for General Purpose (shared) deployments; apply agency-based billing for Specific Purpose (agency-dedicated) deployments.

* Ensure non-prod and production financial approvals are always separate submissions; never combine to avoid approval delays.

* Identify reserved instance and Azure savings plan coverage gaps for session host VM SKUs; recommend RI purchases to the Omnicom finance team for approved host pools.

7. Scaling Plan Design & Operations Standards

* Define and document scaling plan configurations for every host pool using the solution document Scaling Plan tab; set environment (Prod/Dev/UAT) and confirm all schedule parameters.

* Enforce the weekday normal schedule standard: 7:00 AM Breadth First ramp-up

* Define the patching schedule: non-prod weekday 3:00 AM Depth First

* Authorize scaling plan enablement after the 24-hour Intune/SCCM settling window; confirm Intune CSP completion with the Endpoint team before instructing the Day-1 or Day-2 Engineer to enable.

* Scaling plan scope: all 66 host pools; weekday normal, weekday patching non-prod, and weekend patching prod schedules.

8. Networking & NSG Governance

* Define subnet requirements for every host pool

* the NSG baseline for all host pool subnets: inbound rule set

* Govern NSG rule lifecycle

* Own the private endpoint DNS design

* Manage the KMS UDR requirement for Windows activation on all session host subnets.

* Networking scope: VNet, subnets, NSG, UDR, TAO connectivity, InfoBlocks DNS, private endpoints.

9. Escalation, Support Model & Stakeholder Management

* Serve as the L3 escalation owner for all design-level, capacity, and security architecture issues escalated from the Day-2 AVD Support team.

* Present solution designs and cost estimates to agency CFOs, technical leads, and IT financial approval workflow for all new deployments.

10. Standards, Documentation & Knowledge Management

* Own and maintain all AVD standards documentation: AVD Design Document,

* Support Contacts, NPA GW, AV Exclusion, Comm Matrix, Data Retention Policy, TAGS), and Naming Standards

* Maintain the SharePoint site AVD folder as the single source of truth for all AVD artefacts

* Update the Deployment Summary spreadsheet after every completed build; ensure Deployment Summary reflects the live estate accurately for capacity planning and cost reporting.

* Conduct and document knowledge transfer sessions for Incoming team SA onboarding; participate in shadow sessions with the Day-1 Build Engineer for all new builds during the transition period.

=================================================================

Qualifications & Certifications

Microsoft Certified: Azure Solutions Architect Expert

Microsoft Certified: Azure Virtual Desktop Specialty

8+ years in cloud infrastructure engineering; minimum 5 years specifically in Azure Virtual Desktop

Demonstrated experience designing AVD at enterprise scale: 500+ users, multiple Azure regions, multi-tenant deployments

Experience in a managed service or outsourced IT environment operating to ITSM/ITIL standards

Preferred candidate profile