Azure Devops Engineer

Role & responsibilities

Job Description

The DevOps Engineer is a core technical role within the Zybisys Managed Cloud Services practice, responsible for

building, automating, and continuously improving the delivery pipelines, infrastructure provisioning workflows,

and operational automation across a complex multi-region Azure cloud and hybrid on-premises environment.

This role goes beyond traditional pipeline management. The DevOps Engineer at Zybisys is expected to drive an

automation-first culture across the operations team eliminating manual toil through intelligent automation,

codifying infrastructure through IaC, enabling self-service provisioning, and ensuring every deployment and change

follows a consistent, repeatable, and auditable process. The ideal candidate is a builder who is equally comfortable

writing Terraform modules, designing release pipelines, and instrumenting infrastructure for observability.

Key Responsibilities

CI/CD Pipeline Design & Management

Design, build, and maintain CI/CD pipelines using Azure DevOps for infrastructure provisioning,

configuration management, and application deployment workflows across multi-region Azure and

hybrid environments.

Implement branching strategies, pipeline templates, and environment promotion workflows

ensuring consistent progression from development through staging to production with appropriate

approval gates.

Build reusable pipeline templates and task libraries to standardise delivery patterns across all

managed infrastructure components networking, compute, security platforms, and monitoring.

Integrate automated validation steps into pipelines: syntax checks, policy compliance scans (Azure

Policy, Checkov), security scanning, and post-deployment health verification.

Maintain pipeline health monitor build failure rates, pipeline execution times, and flaky tests;

continuously tune pipelines for reliability and speed.Infrastructure as Code (IaC)

• Author and maintain Terraform modules for all managed Azure infrastructure components VNets,

subnets, NSGs, VMs, storage accounts, App Gateways, Load Balancers, Azure Front Door, WAF

policies, and API Management.

Develop Ansible playbooks and roles for configuration management OS hardening, package

installation, service configuration, and post-provisioning validation across Windows Server and Linux

environments.

Manage Terraform state remote state backend design, state locking, workspace strategy for multi-

environment deployments, and state drift detection.

• Write Azure ARM templates or Bicep files for platform-native deployments where Terraform

coverage is limited — Azure Monitor diagnostic settings, Policy assignments, and Marketplace

resource deployments.

Enforce IaC standards and code review practices — peer review all infrastructure code changes,

maintain module versioning, and manage the IaC repository structure and branching conventions.

Deployment Automation & Release Management

• Automate end-to-end deployment workflows for infrastructure changes — from code commit

through validation, approval, deployment, and post-change health verification — aligned with the

ITSM change management process.

Build and maintain blue-green, canary, and rolling deployment strategies for managed platform

components; design rollback automation for rapid recovery from failed deployments.

Coordinate with L2 and Specialist Engineers on release scheduling, maintenance window automation,

and deployment sequencing to minimise service disruption.

Implement deployment readiness checks — pre-flight validation scripts that verify environment state,

dependency availability, and capacity before initiating any deployment.

Maintain a deployment audit trail — every pipeline run must produce a verifiable log of what

changed, who approved it, and what the post-change state is.

Operational Automation & Toil Elimination

Identify and automate repetitive manual operational tasks across L1 and L2 — routine health checks,

housekeeping jobs, certificate renewals, snapshot management, and scheduled maintenance

activities.

Build auto-remediation workflows triggered by monitoring alerts — self-healing scripts that can

restart failed services, reclaim disk space, rebalance loads, or escalate intelligently when automated

resolution is not possible.

Develop event-driven automation using Azure Automation, Azure Functions, Logic Apps, or

equivalent tools — triggered by platform events, ITSM tickets, or scheduled cadences.

Implement self-service provisioning workflows that allow operations teams to request and receive

standard infrastructure components without manual intervention from senior engineers.

• Track and report toil reduction metrics — measure hours saved through automation and report

progress to the Cloud Strategy & Operations Head.Cloud Cost Optimisation Automation

Build automated cost governance workflows — tag compliance enforcement, idle resource detection

and alerting, oversized VM rightsizing recommendations, and reserved instance utilisation reporting.

Develop dashboards and scheduled reports using Azure Cost Management APIs and Power BI or

Grafana integrations to surface real-time cost visibility for operations and client stakeholders.

Implement automated budget alerts, anomaly detection, and cost spike notifications with actionable

context — identifying the specific resource, owner, and recommended action.

• Automate FinOps housekeeping tasks — unattached disk cleanup, orphaned resource identification,

snapshot retention policy enforcement, and unused public IP release.

Observability as Code & Monitoring Automation

Manage Prometheus alerting rules, recording rules, and scrape configurations as code — versioned,

peer-reviewed, and deployed through CI/CD pipelines.

Build and maintain Grafana dashboards as code using Grafana provisioning or Terraform Grafana

provider — ensuring dashboards are version-controlled and reproducible across environments.

• Automate Azure Monitor diagnostic settings, alert rule deployment, and Log Analytics workspace

configuration using IaC — eliminating manual monitoring setup for every new resource deployment.

Integrate deployment pipelines with APM tools (Dynatrace, AppDynamics, or Azure Application

Insights) — automatically enabling instrumentation as part of the deployment process rather than as

a post-deployment manual step.

Build synthetic monitoring and availability test automation for critical services — ensuring proactive

detection of issues before end users are impacted.

Azure Build Planning & Environment Management

Lead the technical planning for new Azure environment builds — subscription design, resource group

structure, naming conventions, tagging taxonomy, and access control framework.

Manage environment lifecycle — provisioning, configuration, decommission, and cost optimisation

across development, staging, and production tiers in multi-region Azure.

Implement Azure Policy as Code — author and deploy custom policy definitions, initiatives, and

compliance remediation tasks through CI/CD pipelines.

Maintain environment parity through IaC — ensuring staging environments accurately reflect

production configuration to eliminate environment-specific deployment failures.

DevSecOps & Compliance

Integrate security scanning into all CI/CD pipelines — static IaC analysis (Checkov, tfsec), secret

detection (git-secrets, Azure Key Vault integration), and dependency vulnerability scanning.

Enforce Azure security baselines through pipeline policy gates — no deployment proceeds if it

violates defined security or compliance thresholds.

Manage Azure Key Vault integration across pipelines — secrets management, certificate rotation

automation, and access policy governance for pipeline service principals.

• Support audit and compliance requirements by maintaining complete, tamper-evident pipeline

execution logs and deployment records.

Preferred candidate profile

Required Skills & Experience

CI/CD & Pipeline Engineering

-

5 – 8 years of overall IT/DevOps experience; minimum 3 years in a dedicated DevOps or platform

engineering role.

• Strong Azure DevOps experience — pipelines (YAML and classic), repos, artifacts, environments,

approvals, and service connections.

-

Experience designing and managing multi-stage CI/CD pipelines with environment promotion,

approval gates, and rollback strategies.

-

Familiarity with Git branching strategies — GitFlow, trunk-based development, and feature flag

integration.

Infrastructure as Code

• Strong Terraform proficiency — module authoring, remote state management, workspace strategy,

provider versioning, and CI/CD integration.

• Ansible for configuration management — role design, inventory management, dynamic inventory,

and Ansible Vault for secrets.

• Azure ARM templates or Bicep — for platform-native resources not well-supported by Terraform

providers.

-

IaC testing frameworks — Terratest, Kitchen-Terraform, or equivalent for validating infrastructure

code before deployment.

Cloud Platform — Azure

• Solid Azure administration knowledge across core services: VMs, VNets, NSGs, Storage, Azure AD,

App Services, AKS (awareness), and platform networking.

• Azure-native automation services: Azure Automation, Azure Functions, Logic Apps, and Event Grid for

event-driven and scheduled automation.

• Azure Policy, Management Groups, and Blueprints — policy-as-code design and compliance

automation.

• Azure Key Vault — secrets management, certificate lifecycle automation, and managed identity

integration with pipelines and applications.

-

Multi-region Azure architecture awareness — understanding of availability zones, region pairs, and

geo-redundancy patterns relevant to deployment planning.

Scripting & Automation

• Strong scripting skills: PowerShell (including Az module), Python, and Bash — for building operational

utilities, automation scripts, and pipeline tasks.

-

REST API and SDK usage — Azure REST APIs, Azure Python/PowerShell SDKs for custom automation

beyond what native tools support.

-

Experience building auto-remediation and event-driven automation workflows that integrate with

monitoring platforms and ITSM systems.Observability & Monitoring Integration

-

Prometheus and Grafana as code — alerting rules, recording rules, dashboard provisioning, and

scrape configuration management through CI/CD.

• Azure Monitor automation — diagnostic settings, alert rules, and Log Analytics workspace

configuration through IaC.

• APM integration experience — instrumenting applications and infrastructure for Dynatrace,

AppDynamics, New Relic, or Azure Application Insights as part of deployment pipelines.

DevSecOps

-

IaC security scanning tools: Checkov, tfsec, or equivalent — integrated into pipelines as mandatory

quality gates.

• Secrets management best practices — Azure Key Vault integration, managed identities, and

elimination of hard-coded credentials in all pipeline and automation code.

• Vulnerability scanning and dependency management — understanding of how to integrate security

tooling into delivery workflows without becoming a bottleneck.

Collaboration & Process

-

Experience working within ITSM-governed change management environments — integrating

automated deployments with change record creation, approval workflows, and post-change

validation.

• Strong documentation habits — every pipeline, module, and automation script must be accompanied

by clear usage documentation and changelog.

-

Collaborative working style — able to translate operational pain points from L1/L2 teams into

automation solutions, and communicate deployment risks clearly to operations leads.

Certification (Preferred)

Domain

Certification

Microsoft Azure

AZ-400 (Azure DevOps Engineer) | AZ-104 (Administrator)

Infrastructure

AZ-305 (Solution Architect — advantageous)

Automation / IaC

HashiCorp Terraform Associate | Red Hat Ansible Automation

DevSecOps

SC-200 (Security Operations) | Checkov / Bridgecrew

Service Management

ITIL v4 Foundation