Role Summary
We are looking for a Principal Cloud Infrastructure Engineer to own the design, automation, and evolution of our Microsoft Azure and Google Cloud platforms. You will set the technical direction for networking, landing zones, IaC, and delivery pipelines across both clouds, and you will use AI-assisted engineering to move faster without lowering the bar on reliability or security. This is a hands-on technical leadership role: you design, build, and mentor.
Key Responsibilities
1. Multi-Cloud Architecture & Design
• Define reference architectures for compute, storage, data, and networking on Azure and Google Cloud Platform, applying the Azure Well-Architected Framework and Google Cloud Architecture Framework
• Lead design reviews and write ADRs; guide workload placement decisions across Azure, Google Cloud Platform, and on-premises
• Design for high availability, zone and region resilience, and defined RTO/RPO targets
• Drive FinOps: rightsizing, reservations and committed use discounts, tagging/labeling standards, budgets and cost guardrails
• Own capacity planning, quota management, and cloud exit/portability considerations
2. Azure Networking
• Design hub-and-spoke and Virtual WAN topologies with VNets, UDRs, VNet peering, Private Link, and private endpoints
• Own hybrid connectivity: ExpressRoute, Site-to-Site VPN, and BGP routing
• Build centralized inspection and egress using Azure Firewall, NVAs, Application Gateway/WAF, and Front Door
• Manage Azure DNS, Private DNS zones, and DNS Private Resolver for hybrid name resolution
• Define IP addressing, NSG/ASG standards, and network segmentation
• Lead network incident response and root cause analysis
3. Google Cloud Platform Networking
• Design Shared VPC and hub-and-spoke architectures using VPC networks, Network Connectivity Center, and VPC peering
• Own hybrid connectivity: Dedicated/Partner Interconnect, HA VPN, and Cloud Router BGP
• Manage Cloud Load Balancing, Cloud NAT, Cloud Armor, Cloud DNS, and Private Service Connect
• Enforce hierarchical firewall policies, VPC Service Controls perimeters, and private Google access patterns
• Define IP address management and cross-cloud connectivity between Azure, Google Cloud Platform, and on-premises
4. Landing Zones & Governance
• Azure: Design and operate Azure Landing Zones using management group hierarchy, subscription vending, Azure Policy initiatives, and Defender for Cloud
• Google Cloud Platform: Design and operate the resource hierarchy (organization, folders, projects), Org Policy constraints, project factory, and baseline guardrails (Cloud Foundation Toolkit / Fabric FAST)
• Centralize logging, security tooling, and shared services in dedicated platform subscriptions and projects
• Standardize identity: Entra ID and Cloud Identity federation, SSO, PIM/just-in-time access, least-privilege RBAC and IAM roles, and break-glass procedures
• Implement tagging, labeling, and policy-driven compliance across both clouds
5. Infrastructure as Code
• Own IaC standards using Terraform (primary) across Azure and Google Cloud Platform, with Bicep and Config Connector where appropriate
• Build versioned, tested, reusable module libraries and enforce them across teams
• Manage remote state, drift detection, and policy-as-code (Azure Policy, OPA, Checkov, Sentinel)
• Define promotion strategy across dev, test, and production environments
6. DevOps & CI/CD Pipelines
• Design secure pipelines in GitHub Actions, GitLab CI, and Azure DevOps for infrastructure and application delivery
• Embed security scanning, policy checks, cost estimation, and automated testing into every pipeline
• Implement GitOps (ArgoCD/Flux) and progressive delivery (blue/green, canary) with Cloud Deploy where relevant
• Use OIDC and Workload Identity Federation for short-lived credentials; eliminate static keys and service principal secrets
• Track DORA metrics and continuously reduce lead time and change failure rate
7. Automation & Scripting
• Build automation in Python, Bash, and PowerShell using Azure and Google Cloud Platform SDKs and CLIs
• Implement event-driven remediation using Azure Functions, Event Grid, Cloud Functions, Cloud Run, and Pub/Sub
• Use Ansible, Azure Automation, and OS Config for configuration management and patch orchestration
• Eliminate toil through measurable automation of repetitive operations
8. AI-Accelerated Engineering
• Apply AI coding assistants and agents (GitHub Copilot, Gemini Code Assist, Claude, and similar) to speed up IaC authoring, pipeline development, code review, troubleshooting, and documentation
• Build AI-assisted workflows for incident triage, log analysis, runbook generation, and PR review
• Set team guidelines for safe AI use: prompt hygiene, no secrets or sensitive data in prompts, human review of all generated infrastructure changes, and validation through plan, lint, and policy gates
• Evaluate platform AI services (Azure OpenAI / AI Foundry, Vertex AI) and MCP-based integrations where they measurably improve delivery speed or quality
• Coach engineers to use AI effectively and track productivity gains
9. Containers & Platform Services
• Design and operate AKS and GKE platforms: cluster lifecycle, networking (Azure CNI, VPC-native), autoscaling, and Helm-based deployments
• Support serverless container platforms such as Cloud Run and Azure Container Apps
• Define container security baselines: image scanning, admission control, Binary Authorization, and pod security standards
10. Security, Compliance & Resilience
• Embed security by design: Key Vault and Cloud KMS/Secret Manager, least-privilege access, private networking, and secure baselines
• Drive continuous compliance through Defender for Cloud, Security Command Center, and audit readiness (SOC 2, ISO 27001, PCI as applicable)
• Own backup and DR strategy using Azure Backup, Site Recovery, Google Cloud Platform backup and DR, and cross-region replication, with regular failover drills
11. Observability & Reliability
• Define monitoring, logging, and alerting standards using Azure Monitor, Log Analytics, Cloud Operations, Splunk, and Dynatrace
• Establish SLOs/SLIs, error budgets, and incident management practices
• Lead blameless post-incident reviews and drive remediation to closure
12. Technical Leadership
• Set platform strategy and roadmap in partnership with engineering, security, and architecture leadership
• Mentor senior and junior engineers; raise engineering standards through reviews and guidance
• Communicate complex technical trade-offs clearly to both technical and executive audiences
• Maintain living documentation: architecture diagrams, network topologies, runbooks, and DR procedures
Required Qualifications
• 10+ years in infrastructure, cloud, or DevOps engineering, with 5+ years on Azure and 4+ years on Google Cloud Platform at production scale
• Expert-level cloud networking on both platforms (ExpressRoute / Interconnect, Virtual WAN / Shared VPC, hybrid routing, firewalling)
• Proven landing zone and multi-subscription / multi-project governance design experience
• Deep Terraform expertise, including module design and CI-driven workflows
• Strong Python scripting and automation skills; PowerShell a plus
• Hands-on CI/CD experience with GitHub Actions, GitLab CI, and/or Azure DevOps
• Strong grasp of identity (Entra ID, Cloud IAM), encryption, and cloud security fundamentals
• Demonstrated, practical use of AI tools to accelerate engineering work
• Track record of leading architecture decisions and mentoring engineers
Preferred Qualifications
• Kubernetes (AKS, GKE), Helm, GitOps
• Observability tooling: Azure Monitor, Cloud Operations, Splunk, Dynatrace
• Event-driven architectures: Event Grid, Pub/Sub, Kafka
• Experience with AWS or multi-cloud connectivity
• FinOps and cost governance experience
• Regulated-industry compliance experience
Core Technical Skills
Domain | Tools |
Azure Networking | VNet, Virtual WAN, ExpressRoute, VPN Gateway, Azure Firewall, Private Link, Front Door, Application Gateway, DNS Private Resolver |
Google Cloud Platform Networking | VPC, Shared VPC, Cloud Interconnect, Cloud VPN, Cloud NAT, Cloud Router, Cloud Armor, Cloud DNS, Private Service Connect, Network Connectivity Center |
Governance | Azure: Management Groups, Azure Policy, Entra ID, PIM, Defender for Cloud | Google Cloud Platform: Resource Manager, Org Policy, Cloud Identity, VPC Service Controls, Security Command Center |
IaC | Terraform, Bicep, ARM, Config Connector, Cloud Foundation Toolkit, Checkov, OPA/Conftest, Terratest |
CI/CD | GitHub Actions, GitLab CI, Azure DevOps, Cloud Build, Cloud Deploy, ArgoCD, Flux, OIDC / Workload Identity Federation |
Containers | AKS, GKE, Cloud Run, Container Apps, Helm, Karpenter-equivalents (NAP/Autopilot), Docker, Trivy |
Automation | Python, Bash, PowerShell, Azure CLI, gcloud, Azure Functions, Cloud Functions, Event Grid, Pub/Sub, Ansible |
Observability | Azure Monitor, Log Analytics, Application Insights, Cloud Monitoring, Cloud Logging, Splunk, Dynatrace, Prometheus, Grafana |
AI Tooling | GitHub Copilot, Gemini Code Assist, Claude, Azure OpenAI / AI Foundry, Vertex AI, MCP integrations |
Preferred Certifications
• Microsoft Certified: Azure Solutions Architect Expert (AZ-305)
• Microsoft Certified: DevOps Engineer Expert (AZ-400)
• Microsoft Certified: Azure Network Engineer Associate (AZ-700)
• Google Professional Cloud Architect
• Google Professional Cloud Network Engineer
• Google Professional Cloud DevOps Engineer
• HashiCorp Certified: Terraform Associate/Professional
• CKA (Kubernetes)
Key Behaviours
• Architect's judgment with a builder's hands-on credibility
• Bias toward automation, simplicity, and measurable outcomes
• Calm incident leadership and strong written communication
• Pragmatic, security-minded adopter of AI to move faster safely
• Mentor and multiplier who raises the whole team's capability
