Azure Cloud Architect | ErnstYoung Job

Job Description

The Opportunity

We are looking for an experienced Senior Azure DevOps / DevSecOps Engineer to help design, automate, secure, and optimize enterprise-scale Microsoft Azure environments. This is a hands-on engineering role for someone passionate about cloud technologies, Infrastructure as Code, automation, security, and platform engineering.

You will play a key role in building and enhancing Azure Landing Zones, implementing cloud governance, developing CI/CD pipelines, and driving Azure best practices across security, reliability, operational excellence, and cost optimization. The ideal candidate is capable of assessing existing environments and proactively recommending improvements to cloud architecture, automation, and security.

Key Responsibilities

• Design, deploy, and maintain Azure cloud infrastructure using Infrastructure as Code (Terraform preferred).
• Build and enhance Azure Landing Zones, management group hierarchies, subscription governance, and platform foundations.
• Implement Azure governance controls using Azure Policy, RBAC, Management Groups, and Policy as Code.
• Analyze existing Azure environments and recommend improvements across security, scalability, reliability, performance, and cost management.
• Integrate security controls throughout the software delivery lifecycle following DevSecOps principles.
• Develop and maintain CI/CD pipelines using Azure DevOps, GitHub Actions, or similar automation platforms.
• Support cloud migration and modernization initiatives, including rehosting, re-platforming, and cloud-native transformations.
• Manage Terraform modules, remote state management, reusable infrastructure patterns, and deployment standards.
• Implement monitoring, observability, logging, and operational controls using Azure Monitor, Log Analytics, and related services.
• Collaborate with security, networking, platform, and application teams to establish Azure cloud best practices.

Preferred Qualifications

• Microsoft Certified:
• Azure DevOps Engineer Expert
• Azure Solutions Architect Expert
• Azure Security Engineer Associate
• Experience with Azure Landing Zone Accelerator implementations.
• Experience with Spacelift, Terraform Cloud, or other IaC orchestration platforms.
• Experience with:
• Azure Virtual WAN
• ExpressRoute
• Azure Firewall Premium
• Private DNS Resolver
• Defender for Cloud
• Microsoft Sentinel
• AKS
• Experience operating in regulated enterprise environments.
• Exposure to AWS and/or GCP cloud platforms.

Required Skills & Experience

• 10+ years of experience in DevOps, Cloud Engineering, Platform Engineering, or Infrastructure Engineering.
• Strong hands-on experience with Microsoft Azure services, including:
• Virtual Networks (VNet)
• Azure Virtual Machines
• Azure Storage
• Azure Key Vault
• Azure App Services
• Azure Monitor
• Azure Log Analytics
• Azure DNS
• Azure Private Endpoints
• Azure RBAC and Entra ID integration
• Proven experience implementing Infrastructure as Code using Terraform.
• Experience designing and implementing Azure Landing Zones and enterprise-scale Azure governance.
• Strong understanding of Azure Management Groups, Azure Policy, subscription vending, and governance frameworks.
• Experience building and managing CI/CD pipelines using Azure DevOps and/or GitHub Actions.
• Experience supporting Azure migration and modernization projects.
• Strong knowledge of Azure security services and best practices, including:
• Microsoft Defender for Cloud
• Azure Key Vault
• Managed Identities
• Private Link
• Network Security Groups
• Just-In-Time Access
• Zero Trust principles
• Strong troubleshooting, analytical, and problem-solving skills.
• Ability to review existing environments and drive continuous improvement initiatives.

Preferred Qualifications

• Microsoft certifications such as:
• Azure DevOps Engineer Expert
• Azure Solutions Architect Expert
• Azure Security Engineer Associate
• Azure Administrator Associate
• Experience with Azure Landing Zone (ALZ) implementations.
• Experience with Spacelift or other Infrastructure as Code orchestration platforms.
• Knowledge of Policy as Code, compliance automation, and governance frameworks.
• Experience with Microsoft Defender for Cloud, Sentinel, and Azure security monitoring solutions.
• Containerization and orchestration experience, including:
• Docker
• Kubernetes
• Azure Kubernetes Service (AKS)
• Experience with hybrid and multi-cloud environments (AWS and/or GCP).

Skills and Attributes for Success

• Passion for cloud technologies, automation, and infrastructure engineering.
• Strong DevSecOps mindset with a focus on security by design.
• Ability to identify inefficiencies and propose practical, scalable solutions.
• Strong communication and stakeholder management skills.
• Continuous learning mindset and commitment to cloud best practices.
• Ability to work effectively in cross-functional and globally distributed teams.

Nice to Have

• Experience with Azure Firewall Premium, Private DNS, Virtual WAN, ExpressRoute, and enterprise networking.
• Experience implementing centralized logging and monitoring architectures.
• Experience with FinOps and Azure cost optimization initiatives.
• Familiarity with Microsoft Cloud Security Benchmark (MCSB), Landing Zone accelerators, and enterprise governance frameworks.
• Experience supporting regulated or highly controlled enterprise environments.

What We're Looking For

We are looking for an engineer who enjoys building secure, scalable cloud platforms and who can combine technical expertise with innovation and continuous improvement. You should be comfortable operating at both strategic and hands-on levels, helping organizations accelerate cloud adoption while maintaining strong governance, security, and operational excellence.