Senior Infrastructure Engineer — Secure Developer Platforms (Azure / VDI)
About The Position
Oteemo is seeking a Senior Infrastructure Engineer to build a secure, self-service developer sandbox within a regulated energy utility’s Azure tenant. The role will deliver non-persistent, streamed desktops using Azure Virtual Desktop (AVD) and Omnissa Horizon that reset at logoff while preserving developers’ work. Traffic must pass through TLS-inspected egress, with desktop startup under one minute. The engineer will own the solution from the landing zone through golden-image management. The engineer will build segmented Azure networking and inspected egress, maintain image-building and endpoint-control pipelines, implement identity and policy guardrails, and route operational logs to security monitoring platforms. The role also includes creating ephemeral self-service resources, enabling human-approved AI-agent proposals for image promotions, and providing architecture documentation, runbooks, and a support model.
Requirements
- Bachelor's degree in a related field or equivalent practical experience.
- At least 8 years of infrastructure or platform engineering experience, including at least 4 years of hands-on Azure experience in an enterprise or regulated environment.
- Experience delivering at least one production AVD or Omnissa/VMware Horizon deployment, including non-persistent pools, image lifecycle, and FSLogix or DEM/App Volumes at scale.
- Deep experience with VNets, UDRs, Azure Firewall (Azure Firewall Premium TLS inspection preferred), Private Link, DNS, and NSGs, including troubleshooting broken TLS chains.
- Expertise in Terraform or Bicep operated through CI/CD, Packer or Azure Image Builder, Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy.
- Working knowledge of Windows 11 multi-session hardening and Linux for container workloads.
- Clear writing skills and ability to obtain design approval from a Cyber Risk reviewer.
Nice To Haves
- Azure certifications: AZ-104, AZ-700, AZ-140, or AZ-305.
- Terraform Associate certification.
- VCP-DTM certification.
- Experience tuning CarbonBlack App Control, BeyondTrust EPM, CrowdStrike, or Defender for Endpoint for developer workloads.
Responsibilities
- Deploy pooled AVD and Omnissa Horizon instant-clone desktops streamed over HTTPS port 443, and conduct a proof of concept to select the platform.
- Persist developer state using FSLogix or Dynamic Environment Manager and App Volumes.
- Build hub-and-spoke VNets segmented from production, with forced-tunnel egress through Azure Firewall Premium, TLS inspection and IDPS, private endpoints, and DNS.
- Tune traffic inspection to support Git, package managers, GitHub Copilot, and AI/MCP endpoints.
- Own Azure Image Builder or Packer pipelines publishing to Azure Compute Gallery, including image building, patching, CIS hardening, scanning, and publishing.
- Maintain CarbonBlack App Control allow-lists and BeyondTrust EPM across desktop rebuilds.
- Enforce infrastructure guardrails as code using Azure Policy and Terraform or Bicep.
- Configure a non-production identity tenant, per-project RBAC, and Key Vault.
- Forward firewall, desktop, and provisioning logs to Sentinel or Splunk.
- Build ephemeral resource templates with time-to-live settings and an orphaned-resource reaper.
- Expose image pipelines so AXIOM AI agents can propose image promotions for human approval.
- Deliver architecture documentation, runbooks, and a support model.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
