Track Manager - Azure DevOps, Terraform

We are seeking a skilled Infrastructure as Code (IaC) Engineer with deep expertise in Azure Bicep and strong proficiency in Terraform to design, develop, and maintain cloud infrastructure at enterprise scale. As our organization standardizes on Azure-native tooling, Bicep is our primary IaC language for new deployments, while Terraform remains essential for managing existing infrastructure and multi-provider scenarios. You will work closely with the GenAI Centre of Excellence (CoE), platform engineering, and application teams to deliver secure, repeatable, and auditable infrastructure automation.

• Serve as a subject matter expert on Azure Bicep, driving adoption as the primary IaC language for all new Azure deployments
• Design and build enterprise Bicep module libraries with well-defined parameters, outputs, user-defined types, and comprehensive documentation
• Implement Bicep template specs and module registries (Azure Container Registry) for centralized module versioning and distribution across teams
• Author Bicep parameter files (.bicepparam) for environment-specific configurations with type safety and validation
• Develop subscription‑scope and management‑group‑scope deployments for Azure Policy, RBAC, and resource group provisioning
• Build deployment stacks to manage lifecycle of resources, prevent accidental deletion, and enforce deny settings
• Perform ARM template decompilation (az bicep decompile) to migrate legacy JSON templates to Bicep
• Implement what‑if deployments (az deployment group what‑if) and preflight validation before production rollouts
• Leverage Bicep extensibility features including user‑defined types, functions, and import statements for modular design
• Create reusable patterns for common Azure topologies: hub‑spoke networking, landing zones, and spoke deployments
• Integrate Bicep linter rules and custom linter configurations to enforce coding standards across teams
• Build CI/CD pipelines for Bicep using Git Hub Actions / Azure Dev Ops with automated validate, what‑if, and deploy stages
• Develop Bicep‑based Azure Verified Modules (AVM) patterns for organizational standards
• Apply conditional deployments, loops, and batch sizing for complex multi‑resource provisioning

• Maintain and enhance existing Terraform modules following DRY principles and enterprise standards
• Implement multi‑environment deployments (dev, test, UAT, prod) using work spaces, backend configs, and .tfvars files
• Manage Terraform state securely using Azure Storage backends with state locking and encryption
• Develop and enforce naming conventions, tagging strategies, and variable management patterns
• Build CI/CD pipelines (Git Hub Actions / Azure Dev Ops) for automated plan, validate, and apply workflows
• Conduct code reviews for Terraform pull requests ensuring quality, security, and compliance
• Support migration efforts from Terraform to Bicep where strategically appropriate
• Leverage Terraform for multi‑cloud or hybrid scenarios where Azure‑native Bicep is not applicable

• Cloud Infrastructure & Architecture
  • Compute:
    Virtual Machines, VM Scale Sets, App Services, Container Apps, AKS
  • Networking: VNets, Subnets, NSGs, Application Gateways, Private Endpoints, DNS
  • Storage:
    Storage Accounts, Blob, File Shares, Data Lake
  • Databases:
    Azure SQL, Cosmos DB, PostgreSQL Flexible Server
  • Integration:
    Logic Apps, API Management, Service Bus, Event Grid
  • Monitoring:
    Application Insights, Log Analytics, Azure Monitor, Dashboards, Workbooks
  • Security:
    Key Vault, Managed Identity, RBAC, Azure Policy, Defender for Cloud
  • Design infrastructure that aligns with the Azure Well‑Architected Framework (reliability, security, cost optimization, operational excellence, performance efficiency)
• Governance, Security & Compliance
  • Implement Azure Policy as Code for guardrails and compliance enforcement
  • Apply least‑privilege RBAC role assignments using managed identities
  • Ensure secrets management via Azure Key Vault with zero hardcoded credentials
  • Support audit and compliance requirements through infrastructure documentation and drift detection
  • Integrate security scanning (tfsec, checkov, trivy) into CI/CD pipelines
• Collaboration & Documentation
  • Maintain comprehensive module documentation, architecture diagrams, and runbooks
  • Collaborate with application teams to define infrastructure requirements and patterns
  • Contribute to the shared module library strategy for enterprise‑wide reuse
  • Mentor junior team members on IaC best practices and cloud patterns
  • Participate in the GenAI CoE initiatives to enable AI/ML infrastructure workloads