Senior Azure Cloud Architect

Cutsforth•Ferndale, WA

3d•Remote

About The Position

Designs, governs, and optimizes Cutsforth’s enterprise Azure cloud platform, establishing the landing zones, network topology, identity model, and security controls that host the company’s software and data products. Partners with software engineering, security, and operations to deliver scalable, secure, and cost-effective cloud architecture that supports Cutsforth’s connected monitoring and industrial product offerings.

Requirements

Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent professional experience
8-12 years of cloud engineering experience, including 5+ years architecting production Azure environments at enterprise scale
Deep expertise with Azure Landing Zones and the Cloud Adoption Framework (CAF) Enterprise-Scale, including management group hierarchy, subscription vending, and policy-driven governance
Infrastructure as Code mastery with Terraform (Azure Verified Modules) and/or Bicep, including reusable module design, state management, and CI/CD-driven deployments
Strong Azure networking experience: hub-and-spoke and Virtual WAN topologies, Azure Firewall Premium, Private Link/Private Endpoints, NSGs, UDRs, and hybrid connectivity (ExpressRoute, VPN Gateway)
Production Azure Kubernetes Service (AKS) experience: cluster design, Azure CNI networking, workload identity, autoscaling, and GitOps (Flux/ArgoCD)
Microsoft Entra ID expertise (Conditional Access, PIM, managed identities), Entra External ID for B2C/customer identity, and RBAC at scale
Hands-on experience with Azure security and compliance tooling: Microsoft Defender for Cloud, Microsoft Sentinel (SIEM/SOAR), Azure Policy, Key Vault, and Defender for Containers/Servers
Cost optimization and FinOps experience (reservations, savings plans, tagging strategy, chargeback/showback)
Observability fluency with Azure Monitor, Log Analytics, Application Insights, and KQL
Ability to lead Azure Well-Architected Framework reviews across reliability, security, cost, operational excellence, and performance
Strong DevOps background with GitHub Actions / Azure DevOps Pipelines, branch strategy, secrets management, and supply-chain security (SBOM, signed artifacts)
Successfully pass background check for cybersecurity site access
Expert-level command of Microsoft Azure architecture at enterprise scale, with the ability to set platform standards others build against
Skilled at translating business and compliance requirements into governed, policy-driven cloud designs
Fluent in Infrastructure as Code practices and able to enforce repeatable, automated deployments across teams
Able to lead architecture and Well-Architected reviews, balancing reliability, security, cost, operational excellence, and performance
Strong communicator who can explain cloud architecture and trade-offs to both engineers and non-technical stakeholders
Capable of managing multiple concurrent initiatives and guiding the technical decisions of other engineers
Security-minded, with a working understanding of compliance frameworks relevant to industrial and customer-facing systems

Nice To Haves

Azure Solutions Architect Expert (AZ-305) and DevOps Engineer Expert (AZ-400) certifications
AWS Solutions Architect Professional, Google Cloud Professional Architect, or equivalent certification
Experience mapping architecture to compliance frameworks such as SOC 2, ISO 27001, FedRAMp, and industrial standards (IEC 62443)
Multi-cloud experience with AWS (Organizations, Control Tower, EKS, IAM) and cross-cloud landing zone parity
GCP experience with Vertex AI, BigQuery, Cloud SQL, and GKE
ML/AI engineering experience with Azure AI Foundry / Azure Machine Learning, including model deployment, endpoints, and MLOps pipelines
Familiarity with RAG architectures, vector databases, and LLM application patterns
Production GenAI experience including agent orchestration, prompt/eval pipelines, and responsible-AI governance
Experience with model serving, inference optimization, and GPU capacity planning

Responsibilities

Design and maintain Azure Landing Zones using the Cloud Adoption Framework (CAF) Enterprise-Scale, including management group hierarchy, subscription vending, and policy-driven governance
Build and maintain Infrastructure as Code using Terraform (Azure Verified Modules) and/or Bicep, with reusable modules, managed state, and CI/CD-driven deployments
Architect hub-and-spoke and Virtual WAN network topologies using Azure Firewall Premium, Private Link/Private Endpoints, NSGs, UDRs, and hybrid connectivity (ExpressRoute, VPN Gateway)
Design and operate production Azure Kubernetes Service (AKS) clusters, including Azure CNI networking, workload identity, autoscaling, and GitOps delivery (Flux/ArgoCD)
Implement identity and access architecture with Microsoft Entra ID (Conditional Access, PIM, managed identities), Entra External ID for customer identity, and RBAC at scale
Establish security and compliance tooling using Microsoft Defender for Cloud, Microsoft Sentinel (SIEM/SOAR), Azure Policy, Key Vault, and Defender for Containers/Servers
Map cloud architecture to compliance frameworks such as SOC 2, ISO 27001, FedRAMp, and IEC 62443, and support audit and remediation efforts
Drive cost optimization and FinOps practices, including reservations, savings plans, tagging strategy, and chargeback/showback models
Build observability across the platform using Azure Monitor, Log Analytics, Application Insights, and author KQL queries for monitoring and troubleshooting
Lead Well-Architected Framework reviews and strengthen DevOps pipelines (GitHub Actions / Azure DevOps), branch strategy, secrets management, and supply-chain security (SBOM, signed artifacts)