Sr. Cloud Engineer - Azure

What you'll do

• Design and build Azure Virtual Desktop and RemoteApp environments — host pools, workspaces, application groups, FSLogix profile management, image lifecycle, autoscale, and session host patching — supporting thousands of concurrent users across multiple regions.
• Lead migration of remaining Citrix XenApp/XenDesktop workloads onto AVD, including application discovery, packaging, remediation, user acceptance testing, and cutover planning with application owners.
• Build and maintain Azure landing zones: subscription and management group topology, hub-and-spoke networking, ExpressRoute and VPN connectivity, route tables, NSGs, Azure Firewall, and private endpoints for PaaS services with no public egress.
• Write and maintain infrastructure as code in Terraform.
• Implement identity and access design across Entra ID and on-premises Active Directory: hybrid join, Entra Domain Services or AD DS for AVD, conditional access, MFA, Privileged Identity Management, and role-based access aligned to segregation-of-duties requirements.
• Implement platform guardrails with Azure Policy, RBAC, resource locks, tagging standards, and Defender for Cloud; remediate findings and keep the estate at or above the internal secure baseline.
• Own encryption and key management: Key Vault, HSM-backed keys, customer-managed keys, certificate lifecycle, and secrets handling in pipelines.
• Design and test disaster recovery for cloud and hybrid workloads — Azure Site Recovery, backup tiering, immutable/air-gapped copies, cross-region failover — and document RTO and RPO evidence for annual resilience testing.
• Keep the VMware estate stable and supported while it winds down, then decommission it: migrate or rebuild the workloads still running on vSphere and vSAN, reclaim licensing, retire the clusters and the storage, backup, and load balancing tied to them, and confirm each decommission with asset and CMDB records updated.
• Support the Windows Server estate through the transition, across Windows Server 2016–2025, including patching, hardening, and clustering.
• Automate operational work in PowerShell and Azure CLI: provisioning, image builds, health checks, reporting, and remediation runbooks.
• Produce and maintain architecture diagrams, runbooks, build documents, and control evidence; represent your changes in CAB and answer questions from internal audit, risk, and external examiners.
• Provide escalation support for production incidents, participate in the on-call rotation, and complete root cause analysis on major incidents.

• 8+ years in enterprise infrastructure engineering, with 3+ years designing and running production workloads in Microsoft Azure.
• Demonstrated production ownership of Azure Virtual Desktop or RemoteApp at scale — not a lab or pilot. Prior Citrix experience is a strong plus, because you will be migrating away from it.
• Terraform in production, including module design, remote state, and code review discipline.
• Azure DevOps (or GitHub Actions) pipeline authoring for infrastructure deployment, with approval gates and environment promotion.
• Deep Active Directory and Entra ID: forests, domains, OUs, Group Policy, DNS, DHCP, LDAP, sites and replication, and hybrid identity synchronization.
• Azure networking fundamentals: VNet design, peering, private endpoints and Private DNS zones, NSG and firewall rule design, and hybrid connectivity troubleshooting.
• Windows Server engineering across current and legacy versions, including patching, hardening, and clustering.
• PowerShell scripting for automation at scale.
• Disaster recovery design and live failover testing, with the ability to state and defend RTO and RPO numbers.
• Clear technical writing. If it isn't documented, in this environment it didn't happen.

• Experience operating under formal change management — CAB approval, change windows, freeze periods, back-out plans, and no undocumented production changes.
• Understanding of segregation of duties in practice: engineers who build the pipeline do not unilaterally approve their own production deployments.
• Familiarity with the control environment banks operate under — FFIEC guidance, GLBA safeguards, SOX IT general controls, and PCI-DSS where card data is in scope — and comfort producing evidence for internal audit, regulatory examinations, and third-party assessments.
• Experience with privileged access management (CyberArk, BeyondTrust, or Entra PIM) and just-in-time elevation rather than standing administrative rights.
• Data residency and data classification awareness: knowing which workloads can move to cloud, which cannot, and why the answer is sometimes "no. "
• Logging and retention discipline — centralized diagnostic settings, Log Analytics, SIEM integration, and retention periods that satisfy record-keeping obligations.
• Vendor and third-party risk awareness when introducing new tooling into the estate.
• Ability to pass a financial-industry background check and, where applicable, fingerprinting.

• Azure certifications: AZ-104 (Administrator), AZ-140 (Azure Virtual Desktop Specialty), or AZ-305 (Solutions Architect Expert).
• Experience consolidating multiple VDI platforms onto a single delivery platform.
• Have a strong background in Fortinet networking products.
• Enterprise backup and replication tooling: Commvault, Rubrik, Veeam, Zerto, or Azure Backup at scale.
• Exposure to Azure Monitor, Log Analytics workspaces, and KQL for operational reporting.
• Experience in a bank, credit union, insurer, or other examined financial institution.
• Project leadership experience coordinating migrations with application owners and business stakeholders.