Azure Infrastructure Engineer

The Azure Infrastructure Engineer is a hands-on infrastructure role that designs, builds, migrates, secures, and operates production Azure infrastructure extending our on-premises VMware and Windows datacenter. Focus areas: Azure networking, hybrid connectivity, virtual machines and platform services, disaster recovery, and migration execution.

The role is DevOps-savvy, not DevOps engineering: the engineer uses Infrastructure-as-Code, Git, and pipelines to keep infrastructure repeatable and auditable, following and extending team standards.

The engineer partners with Infrastructure, Networking, Security, Database, and Application Development teams and external consultants.

• Independently design, deploy, and maintain Azure infrastructure: landing zones, management groups, VMs, storage, backup, monitoring, and governance.
• Troubleshoot connectivity, performance, access, and availability issues across VM, OS, network, DNS, firewall, and identity layers; perform root-cause analysis and implement durable fixes.
• Develop runbooks and operational standards; participate in incident response, change management (CAB), maintenance windows, and on-call.

• Design and troubleshoot VNets, NSGs, routing/UDRs, hub-and-spoke or Virtual WAN, Azure Firewall, VPN Gateway, and ExpressRoute, including BGP and failover behavior.
• Design name resolution across Azure and on-premises (Private DNS, DNS Private Resolver, conditional forwarding).
• Implement private connectivity to PaaS services using private endpoints.
• Support application delivery with Front Door, Application Gateway, load balancing, and WAF, including TLS certificate lifecycle and failure-mode design when an edge service or policy fails.
• Work with Networking on firewall rules, IP addressing, NAT, and datacenter, branch, and third-party connectivity.

• Plan and execute VMware and Windows migrations to Azure: dependency assessment, Azure Migrate, lift-and-shift, test migrations, cutover, and post-migration support.
• Produce cutover plans, validation checklists, and rollback criteria; execute off-hours production cutovers.
• Support Azure infrastructure for SQL Server migrations (Always On to Azure SQL Managed Instance or SQL Server on Azure VMs).
• Maintain hybrid domain controllers, DNS, and AD integration for Azure workloads.

• Design and test DR using Site Recovery, geo-redundant storage, and region/availability-zone design against RTO and RPO targets.
• Operate Azure Backup and evaluate it against third-party backup and replication platforms for new Azure data stores; document and report recovery test results.

• Provide infrastructure for App Service, Functions, Logic Apps, Service Bus, and API Management: VNet integration, private endpoints, identity, Key Vault, and monitoring.
• Support AKS at the platform level (private cluster, CNI, node pools, ingress, managed identity) with Application Development.

• Build, modify, and troubleshoot Terraform following team standards: modules, remote state, environment separation, and drift.
• Use Git pull requests and code review; maintain Azure DevOps infrastructure pipelines, including approval gates and self-hosted agents reaching private endpoints.
• Automate operations with PowerShell and Azure CLI.

• Apply Entra ID, RBAC, PIM, Conditional Access, and managed identities to enforce least privilege and segregation of duties.
• Implement guardrails with Azure Policy, management groups, tagging, and Defender for Cloud.
• Partner with Security, Compliance, and Audit on PCI DSS, NIST, and CIS controls, remediation, and audit evidence.

• Build Azure Monitor and Log Analytics alerts, workbooks, and dashboards; tune alert noise and logging volume; use Application Insights for tracing.
• Right-size and manage cost with Cost Management, Advisor, reservations, and savings plans, after establishing baselines.

• Share knowledge both ways: train teammates in Azure and cloud practices, and learn from them in their areas of expertise.

Working knowledge

• Platform services: App Service, Functions, Logic Apps, Service Bus, API Management, Azure SQL Managed Instance, SQL Server on Azure VMs.
• Azure Virtual Desktop/FSLogix, Bicep/ARM, Defender for Cloud, and Sentinel.
• AKS, Docker, Helm, and Cosmos DB.

• Azure certifications (AZ-104, AZ-305, AZ-700, AZ-500, AZ-400) or HashiCorp Terraform Associate; must be current.
• AKS platform operations, Azure SQL Managed Instance, or IIS/.NET application migrations.
• PCI DSS audit evidence, CrowdStrike or similar security platforms, and multi-site hybrid environments.
• Experience mentoring peers and using AI tools to speed scripting and troubleshooting.

• Remote; work day would be in Central Time Zone.
• Regular business hours with scheduled after-hours maintenance and cutovers, occasional incident response, and on-call as required; participation in change management (CAB).
• Occasional travel for project work, meetings, or datacenter activities.