Staff Azure Cloud Engineer, Automation

About the Role: We are creating a new Azure cloud platform to serve as the foundation for a multi-year cloud modernization program. We need a Lead Azure Cloud Engineer who can walk in, take design ownership, and start building in week one. This is a hands-on, individual-contributor role: you will write the code yourself, stand up the pipelines yourself, and set the technical bar the rest of the teams build against. You are the senior-most and dedicated cloud engineering voice on this program. You need to be well-rounded: as comfortable troubleshooting a firewall rule or a network route as you are writing a Terraform module or designing the pipeline that deploys it. You will need to work with the firm's existing IT, security, and network teams to land on shared standards, and then you're the one who codifies them into automation. Tools and Stack You'll Work In: Azure (landing zone, networking, Entra ID) - Terraform + Terraform Cloud - Azure Verified Modules - GitHub Actions - Microsoft Defender for Cloud - Azure Policy - Azure Monitor / Log Analytics - GitHub Copilot / Anthropic Claude (AI-assisted delivery). Our policy-as-code and shift-left scanning has not been finalized; helping evaluate and select this tooling is part of the role. An internal developer platform pattern for self-service application delivery (e.g. HashiCorp HCP Waypoint, which integrates with HCP Terraform).

Responsibilities

Design and build the Azure landing zone, aligned to Microsoft's Cloud Adoption Framework design areas (identity, network topology, resource organization, governance, management, security) and reviewed against the Well-Architected Framework's five pillars at each milestone; Build with Azure Verified Modules (AVM) as the base layer, composing right-sized custom Terraform modules on top; Own the Terraform Cloud (TFC) setup end to end; Own hands-on networking and firewall configuration: hub-spoke topology, NSGs, Azure Firewall, WAF rules, private endpoints, and DNS; Work with internal teams to define our to-be cloud native software engineering practice and process, then codify it; Establish policy-as-code guardrails; Build the CI/CD pipeline for infrastructure changes: automatic plan on every pull request, mandatory human review, manual apply gate; Help stand up our shift-left scanning practice; Set up the security and observability baseline; Coordinate with the firm's identity/security and network teams on Entra ID architecture; Set the technical example for module structure, versioning, documentation, and code review standards; Extend the paved path from infrastructure to application delivery

Requirements

6+ years in cloud infrastructure/platform engineering, with real production ownership, not just POCs; A well-rounded Azure Cloud generalist, comfortable across Terraform/IaC, Azure networking, and firewalls/network security; Deep, hands-on Terraform experience: module authorship, remote state, workspace/environment strategy, version pinning, and awareness of the tradeoffs in monorepo vs. per-module repo structures; Strong, hands-on Azure networking and security: hub-spoke topology, NSGs, Azure Firewall, WAF rules, private endpoints, DNS, and hybrid/legacy connectivity patterns, plus identity (Entra ID, RBAC, managed identity) and governance (management groups, Azure Policy); Working knowledge of SOC 2 control families (access control, change management, logging/monitoring, network security) well enough to design a landing zone that satisfies them by default, even without prior formal audit experience; Able to work effectively with the firm's existing security, network, and IT teams; Direct experience building CI/CD pipelines for infrastructure changes (GitHub Actions, Azure DevOps, or equivalent), including plan/apply gating patterns; Working knowledge of policy-as-code approaches (e.g. Sentinel, OPA) and IaC/security scanning practices; Comfortable being the first cloud engineer on the program: able to make and defend decisions yourself; Strong scripting ability (PowerShell, Bash, or Python) for tooling and automation glue; Comfortable defining a self-service application deployment pattern (a “golden path”) that other engineers can use to ship application code without needing deep Terraform expertise themselves

Nice to have

Direct experience with Terraform Cloud/Enterprise specifically (not just open-source Terraform CLI); Prior experience building a landing zone from zero, versus inheriting and extending one; Experience consuming (or ideally contributing to) Azure Verified Modules; Direct experience operating in a compliance-driven environment (SOC 2, HIPAA, or similar) through an actual audit cycle, where controls needed to be demonstrable, not just implemented; Experience mentoring other infrastructure/platform engineers; Experience with HashiCorp HCP Waypoint, or a similar internal developer platform (IDP) approach, for standardizing self-service application deployment; HashiCorp Terraform Associate or Professional certification; Microsoft certifications: AZ-305 (Solutions Architect) and/or AZ-400 (DevOps Engineer); AZ-500 (Security) is a plus