Sr. Cloud Engineer - Azure

Our History: From our start in 2009, Conexess has established itself in 3 markets, employing nearly 200+ individuals nationwide. Operating in over 15 states, our client base ranges from Fortune 500/1000 companies to mid-small range companies. For the majority of the mid-small range companies, we are exclusively used due to our outstanding staffing track record Who We Are: Conexess is a full-service staffing firm offering contract, contract-to-hire, and direct placements. We have a wide range of recruiting capabilities, from help desk technicians to CIOs. We are also capable of offering project-based work. Senior Azure Engineer — Cloud Infrastructure & End User Computing Department: IT Infrastructure Location: Remote but US based Type: Full-time Contract to Hire About the role We are moving away from VMware. The on-premises vSphere and vSAN estate is being turned down, legacy Citrix desktop workloads are moving to Azure Virtual Desktop. This is a hands-on senior engineering role with mentoring of other team members not an advisory role. You will design it, build it, automate it, document it for the auditors, and support it in production. The environment is regulated. Every change is examinable, every privileged action is logged, and recovery objectives are commitments to our regulators, not aspirations. We are looking for an engineer who treats those constraints as part of the design problem rather than an obstacle to it. What you'll do Design and build Azure Virtual Desktop and RemoteApp environments — host pools, workspaces, application groups, FSLogix profile management, image lifecycle, autoscale, and session host patching — supporting thousands of concurrent users across multiple regions. Lead migration of remaining Citrix XenApp/XenDesktop workloads onto AVD, including application discovery, packaging, remediation, user acceptance testing, and cutover planning with application owners. Build and maintain Azure landing zones: subscription and management group topology, hub-and-spoke networking, ExpressRoute and VPN connectivity, route tables, NSGs, Azure Firewall, and private endpoints for PaaS services with no public egress. Write and maintain infrastructure as code in Terraform. Implement identity and access design across Entra ID and on-premises Active Directory: hybrid join, Entra Domain Services or AD DS for AVD, conditional access, MFA, Privileged Identity Management, and role-based access aligned to segregation-of-duties requirements. Implement platform guardrails with Azure Policy, RBAC, resource locks, tagging standards, and Defender for Cloud; remediate findings and keep the estate at or above the internal secure baseline. Own encryption and key management: Key Vault, HSM-backed keys, customer-managed keys, certificate lifecycle, and secrets handling in pipelines. Design and test disaster recovery for cloud and hybrid workloads — Azure Site Recovery, backup tiering, immutable/air-gapped copies, cross-region failover — and document RTO and RPO evidence for annual resilience testing. Keep the VMware estate stable and supported while it winds down, then decommission it: migrate or rebuild the workloads still running on vSphere and vSAN, reclaim licensing, retire the clusters and the storage, backup, and load balancing tied to them, and confirm each decommission with asset and CMDB records updated. Support the Windows Server estate through the transition, across Windows Server 2016–2025, including patching, hardening, and clustering. Automate operational work in PowerShell and Azure CLI: provisioning, image builds, health checks, reporting, and remediation runbooks. Produce and maintain architecture diagrams, runbooks, build documents, and control evidence; represent your changes in CAB and answer questions from internal audit, risk, and external examiners. Provide escalation support for production incidents, participate in the on-call rotation, and complete root cause analysis on major incidents. Required Qualifications: 8+ years in enterprise infrastructure engineering, with 3+ years designing and running production workloads in Microsoft Azure. Demonstrated production ownership of Azure Virtual Desktop or RemoteApp at scale — not a lab or pilot. Prior Citrix experience is a strong plus, because you will be migrating away from it. Terraform in production, including module design, remote state, and code review discipline. Azure DevOps (or GitHub Actions) pipeline authoring for infrastructure deployment, with approval gates and environment promotion. Deep Active Directory and Entra ID: forests, domains, OUs, Group Policy, DNS, DHCP, LDAP, sites and replication, and hybrid identity synchronization. Azure networking fundamentals: VNet design, peering, private endpoints and Private DNS zones, NSG and firewall rule design, and hybrid connectivity troubleshooting. Windows Server engineering across current and legacy versions, including patching, hardening, and clustering. PowerShell scripting for automation at scale. Disaster recovery design and live failover testing, with the ability to state and defend RTO and RPO numbers. Clear technical writing. If it isn't documented, in this environment it didn't happen. Banking and regulatory requirements: Candidates without prior regulated-industry experience will be considered, but must demonstrate they can work within these constraints: Experience operating under formal change management — CAB approval, change windows, freeze periods, back-out plans, and no undocumented production changes. Understanding of segregation of duties in practice: engineers who build the pipeline do not unilaterally approve their own production deployments. Familiarity with the control environment banks operate under — FFIEC guidance, GLBA safeguards, SOX IT general controls, and PCI-DSS where card data is in scope — and comfort producing evidence for internal audit, regulatory examinations, and third-party assessments. Experience with privileged access management (CyberArk, BeyondTrust, or Entra PIM) and just-in-time elevation rather than standing administrative rights. Data residency and data classification awareness: knowing which workloads can move to cloud, which cannot, and why the answer is sometimes \"no.\" Logging and retention discipline — centralized diagnostic settings, Log Analytics, SIEM integration, and retention periods that satisfy record-keeping obligations. Vendor and third-party risk awareness when introducing new tooling into the estate. Ability to pass a financial-industry background check and, where applicable, fingerprinting. Preferred Skills: Azure certifications: AZ-104 (Administrator), AZ-140 (Azure Virtual Desktop Specialty), or AZ-305 (Solutions Architect Expert). Experience consolidating multiple VDI platforms onto a single delivery platform. Have a strong background in Fortinet networking products. Enterprise backup and replication tooling: Commvault, Rubrik, Veeam, Zerto, or Azure Backup at scale. Exposure to Azure Monitor, Log Analytics workspaces, and KQL for operational reporting. Experience in a bank, credit union, insurer, or other examined financial institution. Project leadership experience coordinating migrations with application owners and business stakeholders. Conexess