• 
  Design enterprise Azure Landing Zone architectures following Microsoft Cloud Adoption Framework (CAF)
• 
  Architect Hub-Spoke network topologies with proper IP addressing, subnetting, and VNet peering strategies
• 
  Design Zero Trust security models with defense-in-depth layering
• 
  Create multi-region, high-availability architectures with geo-replication and disaster recovery
• 
  Conduct infrastructure assessments and develop optimization strategies
• 
  Design cost-efficient architectures balancing security, performance, and budget

• 
  Implement NSG-only or Azure Firewall-based security models with deny-by-default rules
• 
  Design Private Endpoint strategies for PaaS services (SQL, Storage, Key Vault, App Service)
• 
  Configure Microsoft Defender for Cloud across workload types (App Service, SQL, Storage, Key Vault, ARM)
• 
  Implement Azure Front Door Premium with WAF (OWASP 3.2, Bot Manager, geo-filtering, rate limiting)
• 
  Design identity solutions with Entra ID, Managed Identities, and RBAC least-privilege access
• 
  Configure Private DNS Zones and VNet links for private name resolution

• 
  Develop and maintain Bicep/Terraform modules for reusable infrastructure patterns
• 
  Build modular IaC for: VNets, NSGs, Private Endpoints, Key Vaults, SQL Servers, App Services, Front Door, Storage Accounts
• 
  Implement configuration-driven deployments using centralized config files (config.json patterns)
• 
  Create PowerShell/Azure CLI deployment scripts with proper error handling and verification
• 
  Build phased deployment strategies with verification checkpoints
• 
  Implement diagnostic settings and Log Analytics integration across all resources

• 
  Deploy Azure App Service with VNet Integration, Private Link, and System-Assigned Managed Identity
• 
  Configure Azure SQL Hyper-scale with geo-replication, Private Endpoints, and Azure AD-only authentication
• 
  Implement Azure Storage with Private Endpoints (Blob, Queue, Table) and proper RBAC
• 
  Configure Application Insights and Log Analytics for observability
• 
  Deploy Azure Virtual Desktop (AVD) with Entra ID Join and automation run-books

• 
  Lead technical architecture discussions with customer IT leadership
• 
  Own end-to-end project delivery from discovery through production deployment
• 
  Conduct infrastructure design reviews and security assessments
• 
  Create architecture documentation and operational runbooks
• 
  Manage customer expectations and project timelines

Requirements

• 
  Hub-Spoke VNet topology design and implementation
• 
  NSG rules with Service Tags and deny-by-default patterns
• 
  Private Endpoints for all Azure PaaS services
• 
  Azure Front Door Premium with WAF configuration
• 
  VNet Peering (regional and cross-region)
• 
  Azure Private DNS Zones and VNet links
• 
  Zero Trust architecture principles and implementation

• 
  Entra ID (Azure AD) for cloud identity
• 
  System-Assigned and User-Assigned Managed Identities
• 
  Azure RBAC with least-privilege role assignments
• 
  Key Vault with RBAC access model (not legacy access policies)
• 
  Conditional Access and MFA strategies

• 
  Bicep (primary) or Terraform for Azure IaC
• 
  Modular IaC patterns with reusable modules
• 
  PowerShell scripting for deployment automation
• 
  Azure CLI for resource management and verification
• 
  Configuration-driven deployments (parameterized templates)
• 
  CI/CD pipelines for infrastructure (Azure DevOps, GitHub Actions)

• 
  Microsoft Defender for Cloud (CSPM + workload protection plans)
• 
  Security architecture (defense-in-depth, threat modeling)
• 
  Regulatory compliance frameworks (ISO 27001, SOC 2, GDPR)
• 
  Azure Policy for governance and compliance enforcement
• 
  NSG Flow Logs and Log Analytics for security monitoring

• 
  Azure App Service (Web Apps, VNet Integration, Private Link)
• 
  Azure SQL (Hyperscale, geo-replication, Private Endpoints)
• 
  Azure Storage (Blob, Queue, Table, Private Endpoints, RBAC)
• 
  Azure Virtual Desktop (Pooled, Entra ID Join, automation)
• 
  Application Insights and Log Analytics

• 
  5+ years hands-on Azure infrastructure experience
• 
  Proven track record with enterprise customers (US/EMEA)
• 
  Multi-region Azure deployments with DR/HA requirements
• 
  Azure Landing Zone implementations (greenfield or brownfield)
• 
  Security-focused architecture design and implementation
• 
  Cost optimization and FinOps experience
• 
  Team leadership or mentoring experience

• 
  Microsoft Certified: Azure Solutions Architect Expert
• 
  Microsoft Certified: Azure Administrator Associate
• 
  Microsoft Certified: Azure Security Engineer Associate
• 
  Azure Network Engineer Associate
• 
  HashiCorp Terraform Associate (if Terraform-focused)

• 
  Security-first mindset: Every design decision considers Zero Trust principles
• 
  IaC discipline: Infrastructure exists as code, not click-ops
• 
  Verification rigor: You validate deployments, not assume success
• 
  Documentation: Architecture decisions and operational knowledge are captured
• 
  Practical problem-solving: You find solutions within budget and timeline constraints
• 
  Continuous learning: Azure evolves rapidly; so should you

• 
  Work on cutting-edge technologies with global enterprise customers
• 
  Opportunity to work with emerging technologies like AI, ML, and Agentic AI
• 
  Remote-first culture with flexibility and work-life balance
• 
  Continuous learning and certification support
• 
  Collaborative environment with focus on innovation
• 
  Career growth opportunities in a rapidly expanding organization
• 
  Competitive compensation with performance-based incentives