Azure Application Engineering Lead

HSO Group B.V. • New York, NY

2d

About The Position

HSO is seeking an Azure Cloud Architect to lead solution design and hands-on delivery of complex Microsoft Azure client engagements. The role owns architecture from discovery through implementation, covering landing zones, migrations, identity and security, infrastructure as code, and cloud governance. The position also leads large-scale migrations and deployments, mentors delivery teams, and builds reusable assets.

The architect designs enterprise Azure platforms and workloads, including landing zones, compute and PaaS patterns, Azure Virtual Desktop, and network topologies. The role leads migration discovery, assessment, planning, cutover, and hypercare; architects identity and security solutions and maps controls to applicable compliance frameworks; and builds IaC frameworks, CI/CD pipelines, automation, observability, resilience, and FinOps practices.

This is a client-facing, hands-on consulting role involving discovery workshops, design sessions, Well-Architected Reviews, architecture presentations, delivery support, mentoring, and pre-sales contributions. The position also calls for technical thought leadership, clear communication with technical and non-technical stakeholders, independent ownership of deliverables, and collaboration with colleagues and clients.

Requirements

• 8+ years of hands-on experience architecting and delivering Azure solutions across networking, compute, storage, identity, and security.
• Proven experience leading Azure migration programs, including assessment, wave planning, cutover, and stabilization.
• Proven delivery of enterprise Azure Landing Zones, including management group design, Azure Policy, RBAC frameworks, and platform automation.
• Solid IaC experience with Terraform and/or Bicep and Azure DevOps or GitHub Actions CI/CD pipelines.
• Strong Azure networking fundamentals, including hub-and-spoke or Virtual WAN, Azure Firewall, Application Gateway/WAF, Private Link, and ExpressRoute/VPN.
• Microsoft Entra ID experience with Conditional Access, PIM, hybrid identity, and Zero Trust concepts.
• Familiarity with Azure security services, including Defender for Cloud, Microsoft Sentinel, Key Vault, and compliance frameworks.
• Azure Virtual Desktop experience, including host pool design, FSLogix profiles, Scaling Plans, and monitoring.
• Proficiency in PowerShell and Azure CLI.
• Strong analytical, problem-solving, and troubleshooting skills.
• Excellent written, verbal, and presentation skills.
• Strong client-facing skills, empathy, and the ability to guide clients through complex technical challenges.
• Ability to work independently, take ownership, and translate goals into actionable outcomes.
• Ability to learn new technologies quickly and apply them in real-world scenarios.
• Ability to collaborate effectively with team members and promote the company’s mission and shared values.

Nice To Haves

• Python experience.
• Experience with tenant-to-tenant Microsoft 365 migrations, including Exchange Online, SharePoint/OneDrive, Teams, and Entra ID coexistence and cutover.
• Microsoft 365 platform experience with Intune, Exchange Online, SharePoint/OneDrive, Teams, and Purview.
• Copilot readiness and governance, Copilot Studio development, and Microsoft Foundry experience.
• AKS/Kubernetes and cloud data platform experience, such as SQL MI, Cosmos DB, Synapse Analytics, or Fabric.
• Pre-sales and consulting delivery experience, including scoping workshops, SOW authoring, and client relationship management.
• Microsoft Certified: Azure Solutions Architect Expert (AZ-305).
• Microsoft Certified: Azure Administrator Associate (AZ-104).
• Microsoft Certified: Azure Security Engineer Associate (AZ-500) or Cybersecurity Architect Expert (SC-100).
• Microsoft Certified: DevOps Engineer Expert (AZ-400).
• Microsoft Certified: Azure Network Engineer Associate (AZ-700).
• Microsoft 365 certification, such as Enterprise Administrator Expert.

Responsibilities

• Architect enterprise-scale Azure Landing Zones aligned to Cloud Adoption Framework and Well-Architected principles, including management groups, subscriptions, Azure Policy, RBAC, and platform automation.
• Define compute and PaaS patterns, including VM/VMSS sizing, AKS, App Service/Functions, and Container Registry as appropriate.
• Architect Azure Virtual Desktop solutions, including host pool design, FSLogix profile strategy, Scaling Plans, and monitoring.
• Lead design sessions, produce Architecture Decision Records, and validate approaches through hands-on proof-of-concept builds.
• Lead cloud migration programs, including on-premises-to-Azure, cloud-to-cloud, and application modernization or refactoring efforts.
• Drive migration discovery and assessment, including dependency mapping, workload inventory, recommendations, and wave planning.
• Manage migration cutover and hypercare, including tooling selection, replication monitoring, test migrations, rollback procedures, and stakeholder communication.
• Architect Zero Trust models with Microsoft Entra ID, including Conditional Access, PIM role patterns, hybrid identity, and app registration governance.
• Define security blueprints using Azure Policy, Defender for Cloud, Microsoft Sentinel, Defender XDR integrations, and Key Vault.
• Map controls to applicable compliance frameworks and drive Secure Score improvements.
• Build modular IaC frameworks in Terraform and/or Bicep, including reusable landing zone modules, policy-as-code, and delivery-team coding standards.
• Design CI/CD pipelines in Azure DevOps and/or GitHub Actions, including environment gates, drift detection, and pre-deployment compliance checks.
• Author automation in PowerShell, Azure CLI, and Python, including bootstrap scripts, governance tooling, and operational runbooks.
• Design observability platforms using Log Analytics, Azure Monitor, workbooks, dashboards, and alerting.
• Architect business continuity and disaster recovery solutions using Azure Backup, Site Recovery, and cross-region topologies, and validate against RTO/RPO targets.
• Lead FinOps efforts, including tagging standards, Cost Management reporting, reservation/Savings Plans strategy, and optimization roadmaps.
• Lead discovery workshops, design sessions, and Well-Architected Reviews; present architecture options and trade-offs to technical and business stakeholders.
• Stay hands-on throughout delivery by validating designs with working code and demonstrating patterns alongside client teams.
• Mentor delivery engineers through design reviews, pairing, and code reviews.
• Design Azure network topologies, including hub-and-spoke or Virtual WAN, Azure Firewall, Application Gateway/WAF, Private Link, ExpressRoute/VPN, and DDoS Protection.
• Contribute to pre-sales through solution scoping, proposal authoring, SOW definition, and engagement estimates.
• Package, deploy, and maintain applications using Intune.
• Manage escalated technical issues calmly, professionally, and with a client-focused approach.
• Communicate complex technical concepts clearly to non-technical stakeholders and provide technical thought leadership in Modern Workplace, system integration, and automation.

Benefits

• Generous paid time off.
• Medical coverage.
• Dental coverage.
• Vision coverage.
• Flexible spending accounts.
• Health reimbursement account.
• 401(k) plan with company match.
• Collaborative teammates in a dynamic and growing professional services environment.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed