Azure Infrastructure Engineer

ARS-Rescue Rooter•Remote,

3d•Remote

About The Position

The Azure Infrastructure Engineer is a hands-on infrastructure role responsible for designing, building, migrating, securing, and operating production Azure infrastructure that extends the company’s on-premises VMware and Windows datacenter. Key areas include Azure networking, hybrid connectivity, virtual machines and platform services, disaster recovery, and migration execution. The role uses Infrastructure-as-Code, Git, and pipelines to maintain repeatable, auditable infrastructure while following and extending team standards; it is DevOps-savvy but is not a DevOps engineering role. The engineer partners with Infrastructure, Networking, Security, Database, and Application Development teams, as well as external consultants. The position is remote, with the workday in the Central Time Zone. Work generally takes place during regular business hours, with scheduled after-hours maintenance and cutovers, occasional incident response, and on-call duties as required. Occasional travel may be needed for project work, meetings, or datacenter activities.

Requirements

Bachelor's degree in IT, Computer Science, Engineering, or a related field; equivalent professional experience is considered.
At least 5 years of enterprise infrastructure engineering experience, including at least 3 years of hands-on production Azure experience.
Hands-on experience with hybrid networking, including VNets, NSGs, routing, DNS, and ExpressRoute or site-to-site VPN; ability to explain tradeoffs and failure behavior.
Direct involvement in on-premises-to-Azure migrations, including preparation, cutover, rollback planning, and post-migration support.
Working knowledge of VMware vSphere, Windows Server, Active Directory, DNS, and Group Policy.
Experience with Azure Backup and Site Recovery, or equivalent disaster recovery design, against RTO/RPO targets.
Working proficiency with Terraform, including state, modules, and environments; PowerShell; Git; and Azure DevOps infrastructure pipelines.
Experience with Entra ID, RBAC, least privilege, and Azure Policy.
Ability to independently troubleshoot and perform root-cause analysis of complex Azure issues.
Experience supporting PCI DSS, NIST, CIS, or similar compliance requirements.
Working knowledge of platform services including App Service, Functions, Logic Apps, Service Bus, API Management, Azure SQL Managed Instance, and SQL Server on Azure VMs.
Candidates must demonstrate each required qualification with specific examples of work performed as an individual contributor.

Nice To Haves

Current Azure certifications such as AZ-104, AZ-305, AZ-700, AZ-500, or AZ-400, or a current HashiCorp Terraform Associate certification.
AKS platform operations, Azure SQL Managed Instance, or IIS/.NET application migration experience.
PCI DSS audit evidence experience, CrowdStrike or similar security platform experience, and experience with multi-site hybrid environments.
Experience mentoring peers and using AI tools to accelerate scripting and troubleshooting.
Working knowledge of Azure Virtual Desktop/FSLogix, Bicep/ARM, Defender for Cloud, and Sentinel.
Working knowledge of AKS, Docker, Helm, and Cosmos DB.

Responsibilities

Independently design, deploy, and maintain Azure infrastructure, including landing zones, management groups, virtual machines, storage, backup, monitoring, and governance.
Troubleshoot connectivity, performance, access, and availability issues across virtual machine, operating system, network, DNS, firewall, and identity layers; perform root-cause analysis and implement durable fixes.
Develop runbooks and operational standards; participate in incident response, change management (CAB), maintenance windows, and on-call duties.
Design and troubleshoot VNets, NSGs, routing/UDRs, hub-and-spoke or Virtual WAN, Azure Firewall, VPN Gateway, and ExpressRoute, including BGP and failover behavior.
Design name resolution across Azure and on-premises environments using Private DNS, DNS Private Resolver, and conditional forwarding.
Implement private connectivity to PaaS services using private endpoints.
Support application delivery with Front Door, Application Gateway, load balancing, and WAF, including TLS certificate lifecycle and failure-mode design.
Coordinate with Networking on firewall rules, IP addressing, NAT, and datacenter, branch, and third-party connectivity.
Plan and execute VMware and Windows migrations to Azure, including dependency assessment, Azure Migrate, lift-and-shift, test migrations, cutover, and post-migration support.
Produce cutover plans, validation checklists, and rollback criteria; execute off-hours production cutovers.
Support Azure infrastructure for SQL Server migrations, including Always On to Azure SQL Managed Instance or SQL Server on Azure VMs.
Maintain hybrid domain controllers, DNS, and Active Directory integration for Azure workloads.
Design and test disaster recovery using Site Recovery, geo-redundant storage, and region/availability-zone design against RTO and RPO targets.
Operate Azure Backup, evaluate it against third-party backup and replication platforms for new Azure data stores, and document and report recovery test results.
Provide infrastructure for App Service, Functions, Logic Apps, Service Bus, and API Management, including VNet integration, private endpoints, identity, Key Vault, and monitoring.
Support AKS at the platform level, including private clusters, CNI, node pools, ingress, and managed identity, in partnership with Application Development.
Build, modify, and troubleshoot Terraform following team standards for modules, remote state, environment separation, and drift.
Use Git pull requests and code review; maintain Azure DevOps infrastructure pipelines, including approval gates and self-hosted agents that reach private endpoints.
Automate operations with PowerShell and Azure CLI.
Apply Entra ID, RBAC, PIM, Conditional Access, and managed identities to enforce least privilege and segregation of duties.
Implement guardrails with Azure Policy, management groups, tagging, and Defender for Cloud.
Partner with Security, Compliance, and Audit on PCI DSS, NIST, and CIS controls, remediation, and audit evidence.
Build Azure Monitor and Log Analytics alerts, workbooks, and dashboards; tune alert noise and logging volume; use Application Insights for tracing.
Right-size and manage costs with Cost Management, Advisor, reservations, and savings plans after establishing baselines.
Share knowledge by training teammates in Azure and cloud practices and learning from teammates in their areas of expertise.