Terraform / CICD Engineer – Azure Cloud Migration
Position Summary
We are seeking an experienced BiCep/ CICD Engineer to support a largescale data
center migration to Microsoft Azure for a healthcare payer organization. This role is
responsible for automating repeatable environment provisioning and deployment
processes, reducing manual effort, and ensuring consistent, compliant cloud
environments across multiple migration waves.
In this role, you will turn approved designs into repeatable Bicep templates and Azure
DevOps pipelines. You will provision landing-zone-aligned infrastructure for each
application and support each one through build, testing, cutover, and hypercare.
The ideal candidate has strong experience with Infrastructure as Code (IaC), CI/CD
pipelines, and Azure platform services, and understands how disciplined automation
reduces risk, accelerates migrations, and improves operational reliability—especially in
regulated healthcare environments (HIPAA/HITECH).
Key Responsibilities
Infrastructure as code (Bicep)
o Author, maintain, and version reusable Bicep modules in a shared module
registry. This covers compute, networking, load balancers, storage, Key
Vault, monitoring, and backup.
o Build application-specific Bicep templates from approved migration
playbooks and target architecture designs.
o Apply the client's naming, tagging, and Azure Policy standards in every
template.
o Validate templates with linting, what-if, and pipeline checks before any
deployment.
CI/CD and automation
o Design and run Azure DevOps YAML pipelines for infrastructure
deployment across non-production and production.
o Implement approvals, environment gates, and service connections that
align with the program's CAB and change process.
o Automate repeatable build and validation steps with PowerShell, Azure
CLI, or Bash to cut manual effort for each wave.
Migration delivery
o Provision landing zone placements for each application: subscriptions and
resource groups, VNets and subnets, NSGs, load balancers, and private
endpoints.
o Support rehost migrations with Azure Migrate, including replication, test
migrations, and cutover.
o Take part in pre-production validation, cutover execution, rollback
rehearsals, and hypercare.
o Keep Azure DevOps Boards up to date and produce the build evidence
needed for each gate (G1–G8).
Security and compliance
o Build security controls into templates: Bastion-only administration, private
access, encryption, diagnostic settings, and log forwarding to Microsoft
Sentinel.
o Work with the Security team on privileged access (CyberArk), EDR
onboarding, and firewall rule requests.
o Make sure deployments meet the program's Security and Logging
Baseline and its HIPAA and HITRUST requirements.
Collaboration
o Work closely with the Cloud Architect, Network and Security leads, and
client platform teams.
o Contribute to playbooks, runbooks, and lessons learned after each wave.
Skills and Qualifications
Required skills
• Bicep (hands-on, production use): modules and module registries, parameters
and parameter files, loops and conditions, outputs, scopes (resource group,
subscription, management group), and what-if deployments.
• Azure infrastructure: VNets, subnets, NSGs, route tables, load balancers, VMs
and availability zones, storage, Key Vault, Azure Monitor, and Log Analytics.
• Azure DevOps: YAML pipelines, environments and approvals, service
connections, Repos, and Boards.
• Landing zones: hub-and-spoke networking, Azure Policy, RBAC, and
management group design.
• Scripting: PowerShell and Azure CLI. Bash is a plus.
• Git: branching, pull requests, and code review.
• Migration delivery: experience moving on-premises workloads to Azure, ideally
using Azure Migrate.
Preferred skills
• ARM templates, or Terraform with experience converting it to Bicep
• Azure Firewall, Azure Bastion, private endpoints, and private DNS zones
• Microsoft Sentinel, Defender for Cloud, and diagnostic settings at scale
• Experience in regulated environments, especially healthcare (HIPAA, HITRUST)
• Familiarity with CyberArk, F5, or Palo Alto in hybrid environments
• Experience working through change control (CAB) and gated delivery
Certifications (preferred)
• Microsoft Certified: Azure Administrator Associate (AZ-104)
• Microsoft Certified: DevOps Engineer Expert (AZ-400)
• Azure Solutions Architect Expert (AZ-305), a plus
Qualifications and attributes
• Bachelor's degree in computer science, engineering, or equivalent experience
• Clear written and spoken communication with client stakeholders
• Ability to work across time zones with US-based client teams
• Disciplined with documentation and evidence, and comfortable working to gates
