Cloud Platform Engineer (Azure)

About the role

This role designs, implements and operates secure, scalable Azure cloud infrastructure supporting enterprise platforms and AI workloads. It follows an end-to-end engineering approach covering infrastructure-as-code, deployment automation, validation and ongoing operations, with a focus on platform reliability, security and continuous improvement.

Key responsibilities

• Build the landing zone: design and deliver spoke networks, firewall policies, private DNS, ingress (App Gateway/WAF) and shared platform services in Bicep, deployed via Azure DevOps pipelines with deployment stacks and evidence gates.
• Execute migrations: plan and run application migration waves, including fresh-build targets, SQL Server database moves (backup/restore, log shipping, AlwaysOn AGs on Azure VMs), file-share and data transfers, and cutovers with parallel-run and rollback plans.
• Engineer identity and access: Entra ID authentication (SSO/SAML), PIM-based just-in-time access, managed identities and entitlement management as code.
• Keep the platform observable and operable: diagnostic settings, Log Analytics, Grafana dashboards, alert rules, smoke-test pipelines and operational runbooks.
• Enforce security: private-endpoint-only PaaS, forced-tunnel egress through a central firewall, zero-trust access from managed Cloud PCs, and Azure Policy guardrails.
• Operate what you build: triage platform incidents using firewall logs, KQL and activity logs, take part in change reviews, and document designs and procedures.

Required profile

• 7+ years in infrastructure or platform engineering, with 3+ years hands-on Azure at enterprise scale.
• Infrastructure as code as a default way of working; Git branching/PR workflows and Azure DevOps or GitHub pipelines.
• At least one substantial datacenter-to-cloud or tenant-to-tenant migration programme, including database moves and cutover planning.
• Clear written communication: PR descriptions, design documents and runbooks are key deliverables.

Required skills

• Bicep strongly preferred (Terraform acceptable); Azure networking such as hub-and-spoke, Azure Firewall, UDRs, private endpoints, Private DNS, VPN/ExpressRoute, Application Gateway/WAF.
• Entra ID, SAML/OIDC federation, PIM, RBAC, managed identities and Microsoft Graph scripting.
• PowerShell required; Python a plus; REST APIs when the CLI falls short.
• Working SQL Server knowledge (backup/restore, authentication models, availability groups).