TTT - RAPToR - GTP - FS - Tax Senior

Senior DevSecOps & Azure Platform Engineer

Experience: 10+ years overall | 5+ years in cloud platform engineering

About the Role

Senior DevSecOps & Azure Platform Engineer to design, build, and operate enterprise-grade cloud infrastructure on Microsoft Azure. This role will own the platform layer that enables feature teams to ship securely and reliably — spanning IaC pipelines, identity & access management, network architecture, policy enforcement, and observability.

Key Responsibilities

• Design and maintain Infrastructure as Code (Bicep, ARM, Terraform) modules for Azure resource including Container Apps, SQL, Cosmos DB, Key Vault, Storage, and Managed HSM.
• Build and operate CI/CD pipelines (GitHub Actions) for infrastructure deployment, policy enforcement, and automated governance.
• Implement and manage Azure RBAC, Entra ID (Azure AD) role assignments, and team onboarding automation at scale.
• Architect and maintain hub-spoke network topologies — VNets, Private Endpoints, Private DNS Zones, NSGs, Route Tables, and APIM integration.
• Define and enforce Azure Policy (deployIfNotExists, deny, audit) for compliance, logging, diagnostics, and cost governance across subscriptions.
• Own subscription onboarding workflows — resource provider registration, policy assignments, tagging standards, and management group placement.
• Drive security-as-code practices: secrets management (Key Vault, HSM), certificate rotation, Wiz integration, vulnerability remediation, and least-privilege access patterns.
• Operate and improve observability — diagnostic settings, log backup policies, alerting, and incident response runbooks.
• Mentor engineers, conduct architecture reviews, and document platform decisions via internal wikis and skills documentation.

Required Skills

• 10+ years in software/infrastructure engineering with 5+ years focused on Azure.
• Deep expertise in Azure Resource Manager, Bicep/Terraform, and modular IaC patterns.
• Strong hands-on experience with GitHub Actions (reusable workflows, environments, OIDC federation).
• Solid understanding of Azure networking — VNet peering, Private Link, DNS resolution, UDRs, and firewall/NVA integration.
• Production experience with Azure RBAC, Managed Identities, Entra ID App Registrations, and PIM.
• Proficiency in scripting (PowerShell, Bash, Python) for automation and operational tooling.
• Familiarity with Azure Policy, Blueprints, and governance at management-group scale.
• Experience securing workloads: CMK encryption, HSM key management, network isolation, and zero-trust patterns.

Preferred Qualifications

• Azure certifications (AZ-500, AZ-104, AZ-305).
• Experience with Jira automation, operational runbooks, and incident management tooling.
• Familiarity with cost monitoring (Azure Cost Management, Snowflake-based dashboards).
• Experience onboarding 50+ subscriptions with automated policy and RBAC pipelines.
• Background in multi-tenant or large-enterprise Azure environments.
• Contributions to internal developer platforms or platform-as-a-product models.

Soft Skills

• Ability to translate complex infrastructure decisions into clear documentation and diagrams.
• Comfortable operating autonomously across multiple teams and domains.
• Strong incident response instincts and a bias toward automation over manual toil.