Cloud Infrastructure Engineer

Customers Bank•Malvern, PA

About The Position

Customers Bank is seeking a Cloud Infrastructure Engineer to operate, secure, and evolve its enterprise Azure platform while moving toward code-driven, pipeline-based infrastructure aligned with Microsoft Cloud Adoption Framework maturity goals. This is an infrastructure operations role that balances engineering projects with day-to-day operational support in a regulated financial services environment. The position supports standards and controls aligned with NIST and FFIEC and calls for an adaptable, curious engineer who advocates for sound practices and shares technical learning with the team. The engineer will maintain enterprise Azure solutions; manage policy-as-code, landing zone standards, networking, hybrid connectivity, security, monitoring, resiliency, and disaster recovery; and build and maintain infrastructure as code through CI/CD pipelines. The role also includes transitioning existing resources to code management, automating recurring operations, producing documentation and compliance artifacts, supporting Microsoft Fabric infrastructure, mentoring engineers, and participating in architecture reviews. Alongside strategic infrastructure work, the role provides daily second- and third-level operational support for Azure services, Entra ID, virtual machines, and performance issues. It participates in an on-call rotation for critical alerts during and after business hours, coordinates escalations with the service desk and NOC, and prepares changes through the ServiceNow process. Candidates must be legally eligible to work in the United States without sponsorship, now or in the future.

Requirements

At least 5 years of enterprise cloud infrastructure and engineering experience, with a strong focus on Azure.
Solid Azure networking fundamentals, including NSGs, routing, DNS, Private Link, and hybrid connectivity troubleshooting.
Hands-on proficiency with Bicep, ARM templates, and Azure Policy.
Experience with Git-based workflows, including branching, pull requests, and code review, and deploying infrastructure through CI/CD pipelines.
Troubleshooting experience with Azure Monitor, Log Analytics (KQL), and Network Watcher.
Strong understanding of Zero Trust and cloud security principles.
Experience with Microsoft Entra ID, hybrid identity, RBAC, managed identities, and Key Vault.
Operational experience with Azure IaaS and PaaS services, including virtual machines, App Services, Azure SQL, and Storage, on Windows and Linux.
Proficiency in PowerShell and Azure CLI for automation and operational support.
Excellent analytical, troubleshooting, communication, and documentation skills.
Demonstrated commitment to continuous learning and professional development.
Working knowledge of formal change management (ITIL or equivalent) and ServiceNow.
Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent experience.
Experience in a regulated industry, including producing compliance evidence aligned with frameworks such as NIST or FFIEC.
Legally eligible to work in the United States without sponsorship, now or in the future.
Ability to participate in an on-call rotation and respond to critical alerts during and after business hours.

Nice To Haves

Experience with Microsoft Fabric or related Azure data platform services such as Synapse or Data Lake, including gateways and private connectivity.
Advanced Bicep module design and pipeline authoring in Azure DevOps or GitHub Actions.
Experience with Defender for Cloud and security baseline hardening (CIS or Microsoft).
Familiarity with Microsoft Cloud Adoption Framework (CAF) and Azure landing zone concepts.
Azure Virtual Desktop and DevBox image and host pool management.
ExpressRoute failover behavior and multi-region network resiliency.
Python scripting.
Azure certifications such as AZ-104, AZ-305, AZ-400, AZ-500, or AZ-700; practical expertise and operational experience are prioritized over certifications.
Familiarity with monitoring, observability, and logging tools including Azure Monitor and Log Analytics.
Familiarity with Agile, Scrum, or related project delivery methodologies.

Responsibilities

Maintain enterprise-scale Azure solutions and follow cloud architecture, security, operational efficiency, and governance best practices.
Implement Azure Policy as code to enforce landing zone standards for management groups, subscriptions, RBAC, and tagging in partnership with Cloud Architecture.
Manage spoke-level network configuration in a hub-and-spoke model, including NSGs, Private Endpoints, Private DNS, and routing, in partnership with Network Engineering.
Troubleshoot connectivity involving DNS, routing, NSGs and firewall rules, private endpoints, Azure Firewall, Application Gateway/WAF, load balancing, and ExpressRoute paths.
Enable secure connectivity for monitoring and operational tooling in coordination with Network Engineering and Information Security.
Operationalize multi-region resiliency strategies for critical platforms and ensure failover and recovery align with FFIEC business continuity expectations.
Execute disaster recovery exercises and failover testing, conduct root cause analysis, and advocate for architecture that improves scalability, recoverability, and stability.
Mature platform operations in alignment with Microsoft Cloud Adoption Framework principles.
Build and maintain Azure infrastructure as code using Bicep and reusable modules, deployed through CI/CD pipelines with peer review and pre-deployment validation.
Transition existing environments to code-managed deployments, including adopting existing resources into code and remediating configuration drift.
Automate recurring operational tasks using PowerShell, Azure CLI, Azure Automation, and pipeline-driven workflows, retiring manual processes where practical.
Improve operational visibility through Azure Monitor, Log Analytics (KQL), workbooks, and actionable alerting.
Develop and maintain technical documentation, runbooks, operational standards, and architecture diagrams, versioning them alongside infrastructure code where practical.
Implement secure cloud patterns aligned with Zero Trust, including Entra ID, Privileged Identity Management, managed identities, Key Vault, and network segmentation.
Collaborate with Information Security on regulatory compliance, vulnerability remediation, segmentation strategies, and audit readiness.
Conduct access reviews, configuration and policy validation, and vulnerability remediation.
Produce operational and compliance artifacts supporting internal audits and regulatory examinations.
Harden Azure workloads against CIS and Microsoft security baselines and track security posture through Defender for Cloud and regulatory compliance initiatives.
Support Microsoft Fabric infrastructure, including private connectivity, cloud and on-premises data gateways, workspace administration, and capacity management.
Mentor engineers on infrastructure as code, Azure operations, and engineering best practices.
Participate in architecture and design reviews.
Provide daily second- and third-level support for Azure services, Entra ID, virtual machines, and performance troubleshooting.
Assist senior engineering staff with operational maintenance, including patch compliance reviews, backup monitoring, and performance tuning.
Participate in routine cloud operations such as onboarding automation, runbook documentation, and performance alert triage.
Execute and document DR readiness steps and root cause analysis for production-impacting events.
Work with the service desk and NOC to route and resolve escalations and maintain operational visibility.
Participate in the on-call rotation, responding to critical alerts during and after business hours and escalating as needed.
Prepare and execute changes through the ServiceNow change management process, including documented plans, testing, validation, and backout steps.
Ensure Azure resource compliance through tagging, configuration reviews, and policy validation.