Cloud Infrastructure Engineer

Arctiq•Whitpain Township, PA

1d•Hybrid

About The Position

Arctiq is hiring a Cloud Infrastructure Engineer for a 6-month contract-to-permanent opportunity with one of its clients. The role requires onsite presence Monday through Thursday at the client’s Malvern, Pennsylvania office, with remote work on Friday. The engineer will operate, protect, and improve an enterprise Azure environment in a regulated financial services setting, supporting a transition to infrastructure defined as code and delivered through pipelines, guided by the Microsoft Cloud Adoption Framework (CAF). This infrastructure operations role combines hands-on engineering with routine support and requires adherence to NIST and FFIEC standards. The role covers Azure platform engineering, networking, resiliency, infrastructure as code, automation, monitoring, security, compliance, and support. The engineer will build and maintain Azure infrastructure with Bicep and CI/CD pipelines; manage networking and hybrid connectivity; implement and test multi-region recovery; apply Zero Trust and security controls; support Microsoft Fabric infrastructure; assist with incident response and escalations; and maintain operational documentation. The position also participates in an on-call rotation and prepares and executes changes through ServiceNow.

Requirements

At least 5 years of enterprise cloud infrastructure and engineering experience, primarily with Azure.
Strong Azure networking skills, including NSGs, routing, DNS, Private Link, and hybrid connectivity troubleshooting.
Hands-on proficiency with Bicep, ARM templates, and Azure Policy; Git-based workflows including branching, pull requests, and code review; and CI/CD infrastructure deployment.
Experience troubleshooting with Azure Monitor, Log Analytics (KQL), and Network Watcher.
Solid understanding of Zero Trust and cloud security, with experience in Entra ID, hybrid identity, RBAC, managed identities, and Key Vault.
Operational experience with Azure IaaS and PaaS, including VMs, App Services, Azure SQL, and Storage on Windows and Linux.
Proficiency in PowerShell and Azure CLI for automation and support.
Working knowledge of formal change management (ITIL or equivalent) and ServiceNow.
Familiarity with Agile or Scrum and monitoring and logging tools.
Strong analytical, troubleshooting, communication, and documentation skills, and a commitment to continuous learning.
Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent experience.
Experience in a regulated industry, including producing compliance evidence aligned to NIST or FFIEC.

Nice To Haves

Experience with Microsoft Fabric or related Azure data services such as Synapse and Data Lake, including gateways and private connectivity.
Advanced Bicep module design and pipeline authoring in Azure DevOps or GitHub Actions.
Experience with Defender for Cloud and security baseline hardening (CIS or Microsoft), and familiarity with CAF and Azure landing zones.
Azure Virtual Desktop and Dev Box image and host pool management experience.
Knowledge of ExpressRoute failover behavior and multi-region network resiliency.
Python scripting.
Azure certifications such as AZ-104, AZ-305, AZ-400, AZ-500, or AZ-700; practical expertise is valued over certifications.

Responsibilities

Maintain enterprise-scale Azure workloads and contribute to architecture and design reviews, applying best practices for architecture, security, efficiency, and governance in line with CAF.
Codify Azure Policy to enforce landing zone standards for management groups, subscriptions, RBAC, and tagging in collaboration with Cloud Architecture.
Manage spoke-level hub-and-spoke networking, including NSGs, Private Endpoints, Private DNS, and routing, and enable secure connectivity for monitoring and operational tools.
Troubleshoot connectivity involving DNS, routing, NSG and firewall rules, private endpoints, Azure Firewall, Application Gateway/WAF, load balancers, and ExpressRoute.
Implement multi-region resiliency for critical platforms; run disaster recovery and failover tests, perform root cause analysis, and improve scalability, recoverability, and stability.
Build and maintain Azure infrastructure as code with Bicep and reusable modules, deploying through CI/CD pipelines with peer review and pre-deployment validation.
Move existing environments to code-managed deployments by importing resources and correcting configuration drift.
Automate recurring tasks using PowerShell, Azure CLI, Azure Automation, and pipelines, replacing manual processes where practical.
Improve visibility using Azure Monitor, Log Analytics and KQL, workbooks, and actionable alerts.
Maintain documentation, runbooks, standards, and architecture diagrams, versioning them with code where practical.
Apply Zero Trust patterns using Entra ID, Privileged Identity Management, managed identities, Key Vault, and network segmentation.
Work with Information Security on compliance, vulnerability remediation, segmentation, and audit readiness; conduct access reviews, validate configurations and policies, and produce evidence for audits and regulatory exams.
Harden workloads to CIS and Microsoft baselines and track security posture with Defender for Cloud and regulatory compliance initiatives.
Support Microsoft Fabric infrastructure, including private connectivity, cloud and on-premises data gateways, workspace administration, and capacity management.
Mentor engineers on infrastructure as code, Azure operations, and engineering best practices.
Provide second- and third-tier support for Azure services, Entra ID, virtual machines, and performance issues; coordinate with the service desk and NOC on escalations.
Assist senior engineers with patch compliance reviews, backup monitoring, performance tuning, onboarding automation, runbooks, and alert triage.
Document disaster recovery readiness steps and root cause analyses for production-impacting events.
Participate in the on-call rotation, responding to critical alerts during and after business hours and escalating as needed.
Prepare and execute ServiceNow changes with documented plans, testing, validation, and backout steps.
Verify Azure resource compliance through tagging, configuration reviews, and policy validation.