Senior Systems and Azure Cloud Engineer

Superior Energy Services is seeking a senior, hands-on engineer to design, deploy, secure, and operate enterprise Azure infrastructure. The immediate priority is establishing the Azure and Microsoft Fabric / OneLake platform foundation, supporting initial deployment, and assuming ownership through a structured transition from the current contractor. This role focuses on Azure infrastructure and platform enablement, including networking, identity, security, provisioning, monitoring, and infrastructure automation. It partners with separate DevOps and data engineering teams but does not own CI/CD pipelines, application releases, data ingestion, transformations, or reporting. Immediate deployment responsibilities * Build governed Azure foundations: landing zones, subscriptions, resource groups, Azure Policy, naming, tagging, budgets, and environment-level cost visibility. Establish an isolated sandbox and controlled DEV, TEST/UAT, and PROD separation. * Provision and administer Fabric capacities and workspaces; configure access, capacity assignment, monitoring, and cost controls. Validate capacity sizing and environment separation against workload and security requirements. * Design and implement VNets, subnets, NSGs, routing, private endpoints, private DNS, firewall/egress controls, and hybrid connectivity. Implement supported Fabric private connectivity and gateway infrastructure in coordination with network, security, and workload owners; validate infrastructure dependencies and service limitations. * Implement approved Microsoft Entra ID integration, Azure RBAC, Fabric platform access controls, least privilege, workload identities, app registrations, and secure secrets management. Coordinate PIM and Conditional Access requirements with identity and security owners. * Develop and maintain infrastructure-as-code using Terraform or Bicep and PowerShell. Provide infrastructure templates, network access, permissions, and deployment identities to the DevOps team; troubleshoot infrastructure-related deployment issues without owning CI/CD or release workflows. * Provision approved network paths, gateway infrastructure, identities, and access controls required for Dynamics 365/Dataverse and REST API connectivity. Implement infrastructure restrictions that limit sandbox access to approved sources and datasets; source connector configuration, ingestion, and data sanitization are outside this role. * Establish infrastructure logging, alerts, audit settings, platform monitoring, and recovery procedures within the assigned infrastructure scope. Maintain configuration baselines, dependency inventories, architecture diagrams, operational runbooks, support boundaries, acceptance criteria, and handoff documentation. Validate backup and recovery readiness and coordinate governance integrations with security and data governance owners.

• Degree in IT, Computer Science, Engineering, or equivalent experience; 10+ years in IT, including 7+ years in cloud/infrastructure roles and 5+ years of hands-on Azure experience.
• Demonstrated delivery of enterprise Azure landing zones, networking, identity, security, governance, Azure SQL connectivity, monitoring, and disaster recovery planning.
• Hands-on experience provisioning and operating infrastructure for Azure-hosted enterprise applications, including Azure App Service, Azure SQL Managed Instance or Azure SQL Database, private networking, managed identities, Key Vault integration, Application Insights, backup, availability, and recovery configuration.
• Demonstrated experience deploying and administering Azure SQL PaaS infrastructure, preferably Azure SQL Managed Instance, including private endpoints, DNS, firewall controls, identity-based access, backup and restore, high availability, monitoring, capacity planning, and disaster recovery.
• Demonstrated experience transitioning newly deployed Azure platforms into operational support, including configuration baselines, dependency inventories, support boundaries, service-health monitoring, incident-response procedures, backup and recovery validation, access reviews, runbooks, knowledge transfer, and acceptance criteria.
• Experience supporting Azure DevOps-based enterprise application environments from an infrastructure perspective, including source-control integration, environment provisioning, deployment identities, service connections, network connectivity, security controls, and troubleshooting infrastructure-related deployment issues. This role supports, but does not own, CI/CD pipelines or application release processes.
• Hands-on Fabric infrastructure and platform administration experience, including capacity provisioning, workspace setup, platform access, secure connectivity, monitoring, and operational support. Fabric data engineering or report development experience is not required.
• Strong Azure networking expertise: VNets, NSGs, UDRs, DNS, VPN/ExpressRoute, segmentation, private access to PaaS, and hybrid connectivity; familiarity with Azure Route Server and BGP.
• Practical Terraform or Bicep, PowerShell, and version-control experience. Ability to supply infrastructure code and deployment prerequisites to DevOps and troubleshoot infrastructure-related deployment failures; ownership of CI/CD or release workflows is not required.
• Working knowledge of Fabric/OneLake concepts sufficient to understand infrastructure dependencies and troubleshoot capacity, access, and connectivity. No requirement to develop lakehouse schemas, notebooks, ingestion pipelines, transformations, semantic models, or reports.
• Experience implementing approved least-privilege access, OAuth/SSO integrations, app registrations, workload identities, encryption, diagnostic settings, and infrastructure audit controls. Familiarity with Defender for Cloud and infrastructure dependencies for Microsoft Purview integrations.
• Strong technical documentation, troubleshooting, and cross-functional communication skills; ability to implement the design and support it operationally, not provide architecture advice only.
• Proven cloud migration and M&A infrastructure integration experience, including assessment, consolidation, modernization, and decommissioning of acquired systems.
• Experience implementing secure access patterns for third-party engineers and contractors, including Azure Virtual Desktop or Windows 365, Conditional Access dependencies, privileged-access separation, network-based access restrictions, standard-user workstation controls, and auditable access to Azure resources.