Senior DevOps Engineer

The role is responsible for designing, implementing, and operating secure and scalable Azure cloud infrastructure supporting enterprise platforms and AI workloads. The position follows an end-to-end engineering approach, covering infrastructure-as-code, deployment automation, validation, and ongoing operations, while ensuring platform reliability, security, and continuous improvement.

Build the landing zone
: design and deliver spoke networks, firewall policy, private DNS, ingress (App Gateway/WAF), and shared platform services in Bicep, deployed through Azure Dev Ops pipelines with deployment stacks and evidence gates.

Execute migrations: plan and run application migration waves - fresh-build targets, SQL Server database moves (backup/restore, log shipping, Always On AGs on Azure VMs), file-share and data transfers over controlled paths, cutovers with parallel-run and rollback plans.

Engineer identity and access
:
Entra  (SSO/SAML for onboarded entities), PIM based just-in-time access models, managed identities everywhere, entitlement management as code.

Keep it observable and operable
: diagnostic settings, Log Analytics, Grafana dashboards, alert rules, smoke-test pipelines, and operational runbooks as part of every deliverable - not as an afterthought.

Hold the security line
: private-endpoints-only PaaS, forced-tunnel egress through central firewall, zero-trust access from managed Cloud PCs, Azure Policy guardrails - and the discipline to work within them (and improve them) rather than around them.

Operate what you build
: triage platform incidents using firewall logs, KQL, and activity logs; participate in change reviews; document designs and procedures in the team's standards structure.

7+ years in infrastructure
or platform engineering, with 3+ years hands on Azure at enterprise scale.

Infrastructure as code as your default working mode
- Bicep strongly preferred (Terraform acceptable), Git branching/PR workflows, Azure Dev Ops or Git Hub pipelines. You should be uncomfortable making portal changes.

Deep Azure networking
: hub-and-spoke, Azure Firewall rules and policy, UDRs, private endpoints and Private DNS, VPN/Express Route, Application Gateway/WAF.

Identity engineering
:
Entra , SAML/OIDC federation, PIM, RBAC design, managed identities, Microsoft Graph scripting.

Scripting fluency
:
Power Shell required;
Python a plus. Comfortable with REST APIs when the CLI falls short.

Migration experience
: at least one substantial datacenter-to-cloud or tenant-to-tenant migration programme, including database moves and cutover planning.

Working SQL Server knowledge (senior roles): backup/restore mechanics, authentication models, availability groups - enough to move and stand up databases confidently, not DBA depth.

Clear written communication
: PR descriptions, design docs, and runbooks are first-class deliverables in this team.