Senior Azure Infrastructure & Network Architect

Client is seeking a highly experienced Senior Azure Infrastructure & Network Architect to serve as the senior hands-on technical authority for Azure infrastructure, enterprise networking, and hybrid connectivity. The architect will work closely with Engineering, Platform, Security, IAM, Data, and application teams to design secure, resilient, scalable, and supportable Azure solutions. This role combines architecture with implementation guidance, complex troubleshooting, modernization, and production-readiness oversight. The architect establishes approved infrastructure and network patterns, evaluates technical alternatives, makes informed recommendations, and ensures security, operational, recovery, and compliance requirements are incorporated into solution designs

What This Role Owns

• Azure landing-zone, management-group, subscription, shared-services, and workload infrastructure architecture
• Enterprise Azure networking, DNS, routing, segmentation, private connectivity, ingress, egress, and hybrid connectivity architecture, network troubleshooting
• Infrastructure and network reference architectures, reusable patterns, technical standards, and architecture decisions
• Architecture consultation and production-readiness reviews for Engineering and Platform initiatives
• Infrastructure resilience, availability, capacity, backup, recovery, failover, and disaster-recovery architecture
• Infrastructure modernization roadmaps, technical-debt reduction, and migration recommendations
• Terraform architecture and reusable infrastructure modules for shared platform and networking capabilities
• Security-by-design integration into Azure infrastructure and network architecture, in partnership with Engineering
• Technical leadership, documentation, mentoring, and cross-functional infrastructure coordination

Key Responsibilities

Engineering Architecture & Consultation

• Partner closely with Engineering teams to understand application, data, availability, performance, connectivity, and deployment requirements
• Translate workload requirements into secure, resilient, scalable, and supportable Azure infrastructure designs
• Evaluate technical alternatives and provide documented architecture recommendations, including operational, security, recovery, cost, and supportability considerations
• Conduct infrastructure architecture and production-readiness reviews for new workloads, major changes, migrations, and production deployments
• Identify cross-team infrastructure dependencies, architectural risks, implementation constraints, and required platform capabilities early in the delivery lifecycle
• Develop reference architectures and approved implementation patterns that Engineering teams can consistently adopt
• Provide hands-on technical guidance during implementation without assuming ownership of application delivery
• Partner with the IAM Engineer to incorporate Entra ID, PIM, managed identities, Conditional Access requirements, and least-privilege design principles into Azure infrastructure architectures.

Security by Design

The Architect should ensure security is incorporated into the design, but should not own security posture management.

• Incorporate approved security, identity, logging, encryption, segmentation, and private-access requirements into infrastructure and network designs
• Partner with the Azure Security Engineer to evaluate public exposure, network trust boundaries, inspection paths, administrative access, and security-control requirements
• Design infrastructure patterns that support least privilege, private connectivity, centralized logging, auditable administration, and policy enforcement
• Ensure architecture proposals address security risks before implementation and document any required exceptions or compensating design measures
• Provide infrastructure and network expertise during security reviews, threat-modeling activities, and remediation planning
• Ensure regulated workloads use architecture patterns appropriate for systems that store, process, transmit, or can access PHI or PII
• Provide architecture guidance for AKS networking, private clusters, ingress and egress, DNS, connectivity, availability, and integration with shared Azure services
• Ensure AKS platform designs align with approved landing-zone, network, resilience, and operational patterns

Enterprise Networking, DNS & Connectivity

• Design and govern Azure networking architectures including hub-and-spoke, Virtual WAN, VNet peering, network segmentation, and multi-region connectivity patterns.
• Architect, implement, and troubleshoot Azure DNS solutions including Azure DNS, Azure Private DNS, DNS Private Resolver, hybrid name resolution, and Private Endpoint integrations.
• Lead the design and operational support of hybrid connectivity solutions including ExpressRoute, Site-toSite VPNs, and secure integration between Azure and on-premises environments.
• Establish and maintain enterprise routing standards leveraging BGP, User Defined Routes (UDRs), route propagation, transit routing, and network segmentation best practices.
• Design and govern Azure security controls including Azure Firewall, Network Security Groups (NSGs), Application Security Groups (ASGs), Private Endpoints, Application Gateway WAF, Front Door, DdoS protection services, and Azure Site Recovery Services.
• Serve as the senior escalation point for complex networking issues involving DNS, routing, firewall policies, Private Endpoints, VNet peering, ExpressRoute, hybrid connectivity, and cross-subscription communication.
• Develop scalable IP address management standards, subnetting strategies, and address space governance to support enterprise growth and cloud modernization initiatives.
• Define approved ingress, egress, and partner connectivity patterns to ensure secure, supportable, and standardized network architectures across production and non-production environments.
• Implement and maintain network observability solutions utilizing Azure Monitor, Network Watcher, Log Analytics, flow logs, packet capture, and diagnostic tooling to support proactive operations and rapid incident response
• Partner with Information Security, IAM, DevOps, and Engineering teams to implement Zero Trust networking principles, secure cloud connectivity, and resilient infrastructure patterns for regulated healthcare workloads.

DevSecOps, IaC & Automation

• Integrate security validation into Terraform and Azure DevOps YAML pipelines and review security-relevant infrastructure changes before production deployment
• Develop automation using PowerShell, Azure CLI, KQL, Logic Apps, Terraform, Bicep, or APIs.
• Validate pipeline service connections and deployment identities for least privilege and appropriate credential handling

Monitoring and Operational Readiness

• Define infrastructure and network observability requirements needed to support availability, performance, capacity management, troubleshooting, and service health
• Ensure architecture patterns include appropriate Azure Monitor, Log Analytics, network diagnostics, health monitoring, and operational alerting capabilities
• Establish operational-readiness requirements for infrastructure and network services before production deployment
• Lead technical root-cause analysis for significant infrastructure, DNS, routing, connectivity, and network incidents
• Convert incident findings into architecture improvements, resilient patterns, technical standards, or modernization initiatives
• Partner with Security Operations and the Azure Security Engineer when infrastructure events involve suspected malicious activity or security-control failures

Compliance, Documentation & Collaboration

• Develop and maintain infrastructure architecture standards, reference architectures, network diagrams, operational procedures, and platform design documentation

• 10+ years of enterprise infrastructure and networking experience, including substantial architecture, implementation, and troubleshooting responsibility
• 7+ years of hands-on Azure infrastructure or cloud-platform experience
• Deep knowledge of TCP/IP, DNS, BGP, routing, segmentation, firewalls, load balancing, and hybrid connectivity
• Demonstrated experience designing Azure landing zones, hub-and-spoke networks, shared services, subscription structures, and multi-region environments
• Hands-on experience with ExpressRoute, VPN Gateway, Azure Firewall, Private Endpoints, Application Gateway, Front Door, and Azure DNS
• Strong Terraform experience developing reusable infrastructure and networking modules
• Experience leading infrastructure modernization, migration, resilience, and disaster-recovery initiatives
• Ability to translate application and business requirements into implementable architecture patterns, diagrams, standards, and technical recommendations
• Demonstrated experience leading complex infrastructure and network troubleshooting across organizational and provider boundaries
• Experience designing infrastructure for healthcare, financial services, or another regulated environment, * Microsoft Certified: Azure Security Engineer Associate (AZ-500) or Cybersecurity Architect Expert (SC-100)
• Azure Solutions Architect Expert, Azure Network Engineer Associate, CCNP
• Terraform certification
• Healthcare, HIPAA-regulated, or other regulated-industry experience
• Experience securing Kubernetes/container environments and cloud-native applications
• Understanding of NIST CSF, CIS Benchmarks, and MITRE ATT&CK
• CISSP, CCSP, GIAC, or comparable security certification
• Master’s or Bachelor’s degree in Information Technology, Information Security, Computer Science, or a related field, or equivalent relevant experience.