Senior Azure & Kubernetes Platform Engineer

DIGIOFFICE•Johns Creek, GA

1d•$115,000 - $140,000•Onsite

About The Position

DigiOffice is seeking a Senior Azure & Kubernetes Platform Engineer with deep investigative, architectural, and security expertise to take ownership of a complex, mature Azure environment that has evolved over 3.5 years with limited governance. The low-hanging fruit is gone. What remains requires an engineer who can think architecturally, work independently, and make sound decisions in the absence of documentation. The right candidate has built Azure environments from the ground up, understands what good governance looks like, and has direct experience cleaning up and securing Azure estates where consultants left behind broad Owner access, undocumented resources, and ungoverned infrastructure.

Requirements

7+ years of infrastructure and cloud engineering experience with deep, hands-on Microsoft Azure ownership.
Demonstrated experience remediating and securing a mature, under-governed Azure environment — not solely greenfield builds or migrations.
Production AKS / Kubernetes ownership — built and operated clusters, not just deployed applications into them.
Expert-level Azure networking: VNets, NSGs, private endpoints, DNS, load balancers, routing, and hybrid connectivity.
Direct experience with Azure Storage Account security, APIM, Service Bus, and application dependency mapping.
Microsoft Entra ID / RBAC design, audit, and enforcement experience.
Infrastructure as Code proficiency — Terraform, Bicep, or ARM.
Scripting and automation — PowerShell, Bash, or Python.
Azure Monitor / Log Analytics and production troubleshooting experience.
Ability to communicate complex technical decisions and cost impacts to non-technical business stakeholders.
Strong Linux systems knowledge.

Nice To Haves

Azure certifications — AZ-104, AZ-305, AZ-400, or equivalent.
Helm, GitOps / Argo CD, CI/CD pipeline experience.
Docker and container runtime expertise.
Enterprise-scale Azure Landing Zone experience.

Responsibilities

Map and document relationships between applications, Storage Accounts, Service Buses, APIs, and Resource Groups across a complex, partially undocumented Azure estate.
Identify ownership of orphaned applications, services, and resources left behind by departed consultants and vendors.
Discover and remediate publicly exposed Storage Accounts, unauthenticated applications, and improperly secured resources.
Assess legacy authentication methods and develop modernization roadmaps aligned to least-privilege and Zero Trust principles.
Prioritize remediation activities and outage windows while balancing business continuity requirements.
Design and enforce subscription governance, Resource Group structure, RBAC policies, and Azure Policy assignments.
Identify and remediate over-permissioned identities including accounts with broad Owner or Contributor access.
Audit and clean up service principals, app registrations, and managed identity assignments.
Implement private endpoints and enforce private access models across Storage Accounts and platform services.
Communicate security remediation plans, architectural impacts, and cost forecasts to both technical teams and non-technical business stakeholders.
Manage and optimize Azure compute, networking, storage, identity, security, monitoring, and cost across the enterprise environment.
Engineer, administer, and troubleshoot Azure Kubernetes Service (AKS) clusters — ownership, not just deployment.
Diagnose complex infrastructure issues at the network layer including TCP/IP, DNS, routing, load balancing, firewalls, and TLS.
Build and maintain Azure infrastructure using Terraform, Bicep, or ARM templates.
Administer Azure API Management (APIM) including policy configuration, authentication, and API gateway management.
Manage Azure Service Bus architecture including namespaces, topics, queues, and subscriptions.
Own Azure cost management including spend analysis, optimization, and cost forecasting for architectural and security improvements.