Azure Infrastructure Engineer

The Azure Infrastructure Engineer is a hands-on infrastructure role that designs, builds, migrates, secures, and operates production Azure infrastructure extending our on-premises VMware and Windows datacenter. Focus areas: Azure networking, hybrid connectivity, virtual machines and platform services, disaster recovery, and migration execution.

The role is DevOps-savvy, not DevOps engineering: the engineer uses Infrastructure-as-Code, Git, and pipelines to keep infrastructure repeatable and auditable, following and extending team standards.

The engineer partners with Infrastructure, Networking, Security, Database, and Application Development teams and external consultants.

Key Responsibilities

Azure Infrastructure Engineering & Operations

• Independently design, deploy, and maintain Azure infrastructure: landing zones, management groups, VMs, storage, backup, monitoring, and governance.
• Troubleshoot connectivity, performance, access, and availability issues across VM, OS, network, DNS, firewall, and identity layers; perform root-cause analysis and implement durable fixes.
• Develop runbooks and operational standards; participate in incident response, change management (CAB), maintenance windows, and on-call.

Hybrid Networking, DNS & Application Delivery

• Design and troubleshoot VNets, NSGs, routing/UDRs, hub-and-spoke or Virtual WAN, Azure Firewall, VPN Gateway, and ExpressRoute, including BGP and failover behavior.
• Design name resolution across Azure and on-premises (Private DNS, DNS Private Resolver, conditional forwarding).
• Implement private connectivity to PaaS services using private endpoints.
• Support application delivery with Front Door, Application Gateway, load balancing, and WAF, including TLS certificate lifecycle and failure-mode design when an edge service or policy fails.
• Work with Networking on firewall rules, IP addressing, NAT, and datacenter, branch, and third-party connectivity.

Migration Execution

• Plan and execute VMware and Windows migrations to Azure: dependency assessment, Azure Migrate, lift-and-shift, test migrations, cutover, and post-migration support.
• Produce cutover plans, validation checklists, and rollback criteria; execute off-hours production cutovers.
• Support Azure infrastructure for SQL Server migrations (Always On to Azure SQL Managed Instance or SQL Server on Azure VMs).
• Maintain hybrid domain controllers, DNS, and AD integration for Azure workloads.

Resiliency, Backup & Disaster Recovery

• Design and test DR using Site Recovery, geo-redundant storage, and region/availability-zone design against RTO and RPO targets.
• Operate Azure Backup and evaluate it against third-party backup and replication platforms for new Azure data stores; document and report recovery test results.

Platform Services Infrastructure

• Provide infrastructure for App Service, Functions, Logic Apps, Service Bus, and API Management: VNet integration, private endpoints, identity, Key Vault, and monitoring.
• Support AKS at the platform level (private cluster, CNI, node pools, ingress, managed identity) with Application Development.

Automation & Infrastructure-as-Code

• Build, modify, and troubleshoot Terraform following team standards: modules, remote state, environment separation, and drift.
• Use Git pull requests and code review; maintain Azure DevOps infrastructure pipelines, including approval gates and self-hosted agents reaching private endpoints.
• Automate operations with PowerShell and Azure CLI.

Identity, Security & Governance

• Apply Entra ID, RBAC, PIM, Conditional Access, and managed identities to enforce least privilege and segregation of duties.
• Implement guardrails with Azure Policy, management groups, tagging, and Defender for Cloud.
• Partner with Security, Compliance, and Audit on PCI DSS, NIST, and CIS controls, remediation, and audit evidence.

Observability & Cost Management

• Build Azure Monitor and Log Analytics alerts, workbooks, and dashboards; tune alert noise and logging volume; use Application Insights for tracing.
• Right-size and manage cost with Cost Management, Advisor, reservations, and savings plans, after establishing baselines.

Collaboration & Cross-Training

• Share knowledge both ways: train teammates in Azure and cloud practices, and learn from them in their areas of expertise.

Required Qualifications

Note: Candidates must demonstrate each item below with specific examples of work they performed as an individual contributor.

• Bachelor's degree in IT, Computer Science, Engineering, or related field; equivalent professional experience considered.
• 5+ years of enterprise infrastructure engineering, including 3+ years of hands-on production Azure.
• Hybrid networking: hands-on VNets, NSGs, routing, DNS, and ExpressRoute or site-to-site VPN; can explain tradeoffs and failure behavior.
• On-premises to Azure migrations: direct involvement in preparation, cutover, rollback planning, and post-migration support.
• Working knowledge of VMware vSphere, Windows Server, Active Directory, DNS, and Group Policy.
• Resiliency: Azure Backup and Site Recovery (or equivalent DR design) against RTO/RPO targets.
• Automation: working proficiency with Terraform (state, modules, environments), PowerShell, Git, and Azure DevOps infrastructure pipelines.
• Identity and governance: Entra ID, RBAC, least privilege, and Azure Policy.
• Independent troubleshooting and root-cause analysis of complex Azure issues.
• Experience supporting PCI DSS, NIST, CIS, or similar compliance requirements.

Technical Skills

Working knowledge

• Platform services: App Service, Functions, Logic Apps, Service Bus, API Management, Azure SQL Managed Instance, SQL Server on Azure VMs.
• Azure Virtual Desktop/FSLogix, Bicep/ARM, Defender for Cloud, and Sentinel.
• AKS, Docker, Helm, and Cosmos DB.

Preferred Qualifications

• Azure certifications (AZ-104, AZ-305, AZ-700, AZ-500, AZ-400) or HashiCorp Terraform Associate; must be current.
• AKS platform operations, Azure SQL Managed Instance, or IIS/.NET application migrations.
• PCI DSS audit evidence, CrowdStrike or similar security platforms, and multi-site hybrid environments.
• Experience mentoring peers and using AI tools to speed scripting and troubleshooting.

Work Details

• Remote; work day would be in Central Time Zone.
• Regular business hours with scheduled after-hours maintenance and cutovers, occasional incident response, and on-call as required; participation in change management (CAB).
• Occasional travel for project work, meetings, or datacenter activities.