Platform Engineer - Azure

Shine is the financial copilot for entrepreneurs and small business owners.

Founded by serial entrepreneurs Rico Andersen and Martin Hegelund, Shine is a leading European fintech unicorn on a mission to restore the joy of running a business, by ending wasted time on financial admin. Shine offers a connected solution for invoicing, accounting, payroll, business accounts, payments, and financing, meaning business owners can focus their energy on growing a healthy business, not held back by manual admin.

Today we’re part of Cegid, a European leader in cloud software for finance and accounting. Together we’re building Europe’s leading financial copilot for small businesses and their accountants.

Shine already supports more than 400,000 small businesses. As part of Cegid, we now reach over one million small businesses and 15,000 accountants across Europe.

We’re a multicultural team working from France, Germany, Denmark and the Netherlands, Spain,Portugal

Just as we respect our customers’ time, we respect yours. Your experience with Shine and Cegid should feel simple, transparent and genuinely supportive.

If this sounds like somewhere you want to grow, we’d love to hear from you.

Our Infrastructure & IT unit builds and operates the cloud platforms, developer tooling, and IT services that underpin every product Shine ships. We run multiple cloud teams (AWS, GCP, Azure), Engineering Efficiency, and IT operations. Infrastructure security is a dedicated function within this unit — senior engineers who own the security posture of our cloud estate as a traversal role across all teams.

We’re looking for a Staff Platform Engineer to own the security of our Azure cloud environment and contribute to multi-cloud security strategy. Azure is a strategic platform for the group, driven by recent acquisitions, and it needs the same security depth we are already building on AWS.

This is a hands‑on, senior IC role. You will define security architecture, build controls as code, harden identity, implement detection, and partner with platform teams to make secure defaults the path of least resistance. You work alongside a peer Staff Platform Engineer who covers AWS and IT, sharing cross‑cloud strategy while owning separate execution domains.

• Define and implement the security architecture for our Azure estate — policy guardrails, network security, encryption, identity hardening, and secure defaults.
• Own the security of our Azure landing zone — the platform teams build it, you ensure it’s built securely and that workloads migrate onto a secure foundation.
• Own Entra  — conditional access, Privileged Identity Management, workload identity governance, federation hardening with Okta, and tenant security.
• Co‑own the onboarding and configuration of our CNAPP platform (e.g. Wiz, Cortex Cloud, Orca, or FortiCNAPP) — posture management policies, finding prioritisation, and workflow integration.
• Build and maintain security controls as code using Terraform and Azure Policy — CIS baselines, automated remediation, integrated into CI/CD.
• Ensure on‑prem → Azure migrations happen securely — risk assessment pre‑migration, controls during, posture validation post.
• Conduct threat modelling for Azure infrastructure designs. Identify attack paths and prioritise controls based on actual risk.
• Automate compliance evidence collection for ISO 27001, GDPR, and DORA.
• Align Azure security patterns with AWS and GCP to maintain a coherent multi‑cloud security posture. GCP security coverage will be shared with your peer as it matures.
• Enable teams: security design reviews,…