Senior Azure Engineer

What you'll do

• Design, build and evolve our Azure landing zone, including management group and subscription design. Most of our technology controls are evidenced against this boundary.
• Design and build Azure networking and hybrid DNS: hub-and-spoke architecture, routing, firewalls, private endpoints and split-resolution patterns. Implement it hands-on with our partner's cloud and network engineers.
• Write and maintain our Terraform modules, state and standards, including code review, pipelines and drift management. You write the core modules and review contributions from partner engineers.
• Build and oversee the shared platform foundations everything else depends on: compute, non-production environments, data gateways, and certificate and secret lifecycle. Partner engineers handle day-to-day operation.
• Set the monitoring, alerting and cost standards for the platform, and forecast capacity before it becomes an incident. Our managed services partner operates the tooling day to day.
• Design and build the foundations our integration services depend on: networking, private connectivity, identity and certificates. Our integration operations team runs API Management, Service Bus and Logic Apps hosting, and API and integration design belongs to our Architecture & Digital Engineering team.
• Partner with our managed services and network engineers, directing their work against your design. Take the complex or high-risk changes yourself, set the standards for routine work, and review their changes, including firewall changes, before they go live.
• Capture what currently lives with individuals in architecture decision records and runbooks, and bring design ownership of the partner-built platform in-house.
• Run backup and disaster recovery work against the Director's strategy and test calendar, and work with partner engineers to run test restores and verify that they succeed. Keep the platform's control evidence ready for auditors, investor due diligence and internal risk reviews.
• Act as hands-on senior escalation for complex platform issues across Azure, networking, DNS and partner-managed services: dig in alongside partner engineers and see them through to root cause. Join architecture design reviews to speak for operability.

What you'll bring

• 8+ years in infrastructure or cloud engineering, including 5+ years designing and running production Azure estates across multiple subscriptions
• Recent hands-on engineering: in the last 12 months you have written Terraform and worked on Azure networking directly, not only designed or reviewed it
• 3+ years of strong Terraform experience: reusable modules, state management, pipelines, code review and drift management
• Deep Azure networking knowledge, including private connectivity and hybrid DNS, plus enough depth in firewalls, NSGs, routing, WAN and zero-trust network access to review a change critically rather than approve it on trust
• Experience working with a managed service provider's engineers as one team: holding the design that they deliver, and rejecting work that does not meet it
• Strong working knowledge of Azure integration services such as API Management and Service Bus, enough to design the networking, identity and certificate foundations they depend on. You will not be running them day to day.
• Fluency in PowerShell, Microsoft Graph and Azure CLI automation
• Documentation habits that survive you: architecture decisions, runbooks and operational detail, so no capability depends on one person