Senior Azure Cloud Engineer

• We’re looking for a senior cloud engineer to own the design of our Azure platform and to engineer it alongside our managed services partner. You will be the technical authority for how the estate is built: the landing zone, Terraform, networking, shared platform services and resilience. You design it, build the critical pieces hands-on, and work with partner engineers who build and run the rest to your standards.
• Part of the job is taking design ownership of a platform that a partner built and still runs, and bringing that knowledge in-house.
• This is a hands-on engineering role, done in partnership. You will write Terraform, work on Azure networking and automate with PowerShell and Azure CLI. You will work every day alongside engineers from our managed services partner, who handle routine operations and carry out changes to your design, so your hands-on time goes to the work that matters most. It is not a management role, and it is not a paper-design role. Expect roughly half your time on hands-on building and fixing, and the rest on design, partner review and escalation.
• You will report to the Director of Infrastructure & Platform Operations and work closely with our integration, architecture, data and security teams. The role includes a share of an on-call rotation for major platform incidents outside business hours.

What you’ll do:

• Design, build and evolve our Azure landing zone, including management group and subscription design. Most of our technology controls are evidenced against this boundary.
• Design and build Azure networking and hybrid DNS: hub-and-spoke architecture, routing, firewalls, private endpoints and split-resolution patterns. Implement it hands-on with our partner’s cloud and network engineers.
• Write and maintain our Terraform modules, state and standards, including code review, pipelines and drift management. You write the core modules and review contributions from partner engineers.
• Build and oversee the shared platform foundations everything else depends on: compute, non-production environments, data gateways, and certificate and secret lifecycle. Partner engineers handle day-to-day operation.
• Set the monitoring, alerting and cost standards for the platform, and forecast capacity before it becomes an incident. Our managed services partner operates the tooling day to day.
• Design and build the foundations our integration services depend on: networking, private connectivity, identity and certificates. Our integration operations team runs API Management, Service Bus and Logic Apps hosting, and API and integration design belongs to our Architecture & Digital Engineering team.
• Partner with our managed services and network engineers, directing their work against your design. Take the complex or high-risk changes yourself, set the standards for routine work, and review their changes, including firewall changes, before they go live.
• Capture what currently lives with individuals in architecture decision records and runbooks, and bring design ownership of the partner-built platform in-house.
• Run backup and disaster recovery work against the Director’s strategy and test calendar, and work with partner engineers to run test restores and verify that they succeed. Keep the platform’s control evidence ready for auditors, investor due diligence and internal risk reviews.
• Act as hands-on senior escalation for complex platform issues across Azure, networking, DNS and partner-managed services: dig in alongside partner engineers and see them through to root cause. Join architecture design reviews to speak for operability.

• 8+ years in infrastructure or cloud engineering, including 5+ years designing and running production Azure estates across multiple subscriptions
• Recent hands-on engineering: in the last 12 months you have written Terraform and worked on Azure networking directly, not only designed or reviewed it
• 3+ years of strong Terraform experience: reusable modules, state management, pipelines, code review and drift management
• Deep Azure networking knowledge, including private connectivity and hybrid DNS, plus enough depth in firewalls, NSGs, routing, WAN and zero-trust network access to review a change critically rather than approve it on trust
• Experience working with a managed service provider’s engineers as one team: holding the design that they deliver, and rejecting work that does not meet it
• Strong working knowledge of Azure integration services such as API Management and Service Bus, enough to design the networking, identity and certificate foundations they depend on. You will not be running them day to day.
• Fluency in PowerShell, Microsoft Graph and Azure CLI automation
• Documentation habits that survive you: architecture decisions, runbooks and operational detail, so no capability depends on one person

Nice to have:

• Experience in financial services or another regulated, audited environment, including producing infrastructure control evidence for audit or investor due diligence
• Azure Solutions Architect Expert (AZ-305), Azure Network Engineer (AZ-700) or HashiCorp Terraform Associate certification
• Microsoft Fabric capacity management, on-premises data gateways or cloud cost management
• Windows infrastructure dependencies (Azure-hosted domain controllers, AD-integrated DNS, Group Policy, DFS) and internal PKI