Azure Cloud Architect + DevOps Engineer

Role overview

This position sits at the point where cloud architecture and day-to-day DevOps operations meet. The environment is built on Azure Container Apps, App Services, Function Apps, Azure AI Search, Cosmos DB for PostgreSQL, Azure Database for PostgreSQL, Storage, Service Bus, Front Door, and an edge CDN provider such as Cloudflare for public-facing domains. The right person will shape the platform’s future design while also owning pipelines, networking, security, and cost management on an ongoing basis. This is a hands-on builder-operator role, not a ticket-queue platform team role, and it requires close collaboration with engineering to deliver faster and at lower cost.

Cloud architecture

• Maintain the Azure architecture diagram for the full platform and keep it up to date.
• Plan structural changes as the product scales, including additional container apps, replica and autoscale policies, search index partitioning, queue design, and multi-region planning.
• Review and approve significant infrastructure changes, such as schema updates on shared databases, new public endpoints, new Key Vault secrets, and cross-service dependencies.
• Set and enforce naming standards, resource tagging conventions for cost centre, environment, and owner, and the resource group structure across subscriptions.

Networking and edge

• Own DNS for both public domains and internal Azure DNS zones.
• Manage Azure Front Door profiles, origins, routes, rules, custom domains, and SSL/TLS configuration.
• Operate the edge CDN platform, including DNS administration, page rules, caching, purge processes, security controls, and related automation.
• Handle Azure Application Gateway where it remains part of the stack.
• Tune WAF policies, investigate false positives, and block abusive traffic without disrupting legitimate users.
• Plan domain migrations, certificate renewals, and cache strategy at the edge.

DevOps and CI/CD

• Own Azure DevOps Pipeline templates for build, test, and release flows, including service connections, variable groups, environment approvals, and artifact retention.
• Improve container build efficiency through smaller images, better layer caching, and shorter build times.
• Set and maintain ACR retention policies.
• Design deployment approaches such as blue/green releases using container app revisions, canary rollouts, and rollback procedures.
• Create reusable pipeline templates that engineering teams can adopt without duplicating code.
• Implement secure secret handling using Key Vault references and credential rotation, reducing reliance on .env files.

FinOps and cost optimisation

• Review Azure spend across all subscriptions on an ongoing basis and present monthly cost updates to leadership.
• Identify and execute savings measures such as right-sizing container apps, reserving compute where workloads are stable, moving to better-fit service tiers, removing unused resources, and reviewing egress and CDN costs.
• Assess the cost-versus-performance impact of proposed architecture changes before they are approved.

Experience and technical expectations

The role requires deep Azure expertise and practical ownership of production systems. The candidate should have at least 6 years of experience with Azure as the primary cloud platform. Strong working knowledge is expected across Azure Container Apps, App Services, Function Apps, ACR, AKS fundamentals, Azure Database for PostgreSQL, Cosmos DB for PostgreSQL (Citus), Storage Blob, Service Bus, Key Vault, Application Insights, and Log Analytics. Experience with Azure Front Door Standard and Premium is essential, along with operational use of an edge CDN provider such as Cloudflare. The role also calls for WAF design and tuning, large-scale DNS management, Azure DevOps YAML pipelines, networking fundamentals such as VNets, NSGs, peering, private endpoints, and service endpoints, scripting in Bash, PowerShell, and Python, Azure CLI usage, and infrastructure as code with Bicep or Terraform, with ARM as a fallback for legacy systems. Prior success in saving money through FinOps practices is required.

Nice-to-have background

• Azure certifications such as AZ-104, AZ-305, or AZ-400.
• Experience managing multiple subscriptions and tenants with Entra ID.
• Familiarity with Kubernetes and AKS.
• Exposure to SRE practices such as SLOs, error budgets, and on-call rotations.
• Experience with observability platforms beyond Application Insights, such as Grafana, Datadog, or ELK.
• Database operations experience, especially PostgreSQL high availability, replication, and point-in-time restore.
• Security experience covering CIS benchmarks, vulnerability scanning, and container scanning.