Azure Platform Engineer

Azure Platform Engineer

The selected professional will join a team currently building an AI Agent Platform on Azure and Delivery AI 360. As the platform evolves into its next phase, the focus will shift toward enabling advanced orchestration, automation, and governance capabilities across GitHub Copilot and the corporate toolchain, while ensuring high standards of security, scalability, compliance, and operational excellence.

Key Responsibilities

• Own and evolve the Azure platform by designing, developing, and maintaining reusable Bicep modules for:

  • Networking (VNet Integration, Private Endpoints, and peering with the corporate core network)
  • Azure Container Apps
  • Azure Container Registry (ACR)
  • Azure Key Vault
  • Azure Cosmos DB
  • Azure Functions

• Design, implement, and standardize CI/CD pipelines using GitHub Actions, including:

  • OIDC federation
  • Runner management
  • Container image build, scanning, and publishing
  • Environment promotion strategies
  • Integration with GitHub Advanced Security
  • Integration with corporate SAST and DAST security tools

• Design, implement, and maintain the identity and access management model using:

  • Microsoft Entra ID
  • User-Assigned Managed Identities
  • Workload Identity Federation
  • Least-privilege Service Principals
  • Project-level RBAC
  • JWT token validation across services and applications

• Operate, secure, and optimize the AI agent platform by managing:

  • Controlled outbound traffic (firewalls and allowlists for remote MCP services)
  • Observability through Application Insights, Log Analytics, and SIEM integrations
  • Auditability, traceability, and continuous monitoring
  • Cost management and governance controls

• Partner with Information Security (InfoSec) and CCS teams to establish and maintain a catalog of pre-approved resources and permissions that minimizes operational friction and reduces ticket volume.

• Provide technical guidance and support to Python development teams related to:

  • Application containerization
  • Deployment and operational best practices
  • Platform architecture and observability standards

Required Qualifications

• 4+ years of hands-on Azure experience supporting production container-based environments, including:

  • Azure Container Apps (internal ingress, revisions, autoscaling, and VNet Integration)
  • Azure Container Registry (ACR)
  • Container image scanning and lifecycle management

• Deep expertise in Microsoft Entra ID, including:

  • App Registrations
  • MSAL and OIDC
  • Token validation (JWKS, Issuer, and Audience)
  • Managed Identities
  • Workload Identity Federation
  • RBAC
  • Conceptual understanding of Conditional Access
  • Experience with Entra External ID is a strong plus

• Advanced experience with Infrastructure as Code (IaC) using Bicep:

  • Reusable modules
  • Environment-specific parameterization
  • Registries
  • Identity federation integration with GitHub Actions

• Experience building and operating containerized Python services, including:

  • FastAPI
  • Multi-stage Docker images
  • Health checks
  • OpenTelemetry
  • Azure Durable Functions in Python (strong plus)

• Solid expertise in Azure private networking:

  • Private Endpoints
  • Private DNS
  • Network Security Groups (NSGs)
  • Integration with corporate firewalls

• Hands-on experience with:

  • Azure Cosmos DB
  • Azure Key Vault
  • Azure Monitor
  • Application Insights
  • Log Analytics

• Experience working in regulated environments such as banking, financial services, or payments, including exposure to:

  • Change Advisory Boards (CAB)
  • Audits and compliance reviews
  • Environment segregation
  • Documentation and evidence management

Preferred Qualifications

• Experience with Azure AI Foundry, including:

  • Model deployment and management
  • Agent Service
  • Model evaluation frameworks
  • Integration with private networking and enterprise identity solutions

• Experience building AI Agent and MCP-based solutions using technologies such as:

  • Semantic Kernel
  • LangGraph
  • AutoGen
  • OpenAI Agents SDK
  • Human-in-the-loop workflows
  • Tool-call governance and execution limits

• Knowledge of:

  • GitHub Advanced Security
  • GitHub Copilot Coding Agent
  • GitHub APIs
  • Azure DevOps

• Experience with Azure Kubernetes Service (AKS):

  • Networking
  • Workload Identity
  • Helm
  • Kustomize
  • GitOps practices

• Experience implementing:

  • Azure Landing Zones
  • Cloud Adoption Framework (CAF)
  • Azure Policy

• Experience building and operating shared internal platforms consumed by multiple engineering teams.

• Preferred Certifications:

  • AZ-400
  • AZ-305
  • SC-300
  • AI-102
  • CKA / CKAD (plus)

Additional Information

Work Arrangement: 100% Remote
Location: LATAM (preference for candidates working in a time zone close to EST)
Language Requirement: Bilingual, with strong technical English communication skills
Contract Duration: Initial 6-month engagement with a high likelihood of extension.