Azure cloud Engineer

Title: Azure Cloud Engineer, Networking & Infrastructure
Location: Midtown NYC (Onsite 3 days a week)
Duration: Six-month contract with potential conversion to a permanent role

Role Overview

We are seeking a hands-on Azure Cloud Engineer to join our Engineering team. This role combines broad Azure infrastructure experience with particular depth in Azure networking, including virtual networks, subnet design, routing, route tables, private connectivity, and network security.

The engineer will help build and improve our Azure environment, including Palo Alto Networks Cloud NGFW for Azure and Strata Cloud Manager. The successful candidate will be comfortable working within an established team, troubleshooting across infrastructure and security boundaries, and delivering changes through Terraform and peer-reviewed workflows.

This is a delivery-focused engineering role. We need someone who can understand an existing environment, contribute sound technical judgment, implement changes safely, and leave maintainable code and documentation for the team.

Key Responsibilities

Azure Infrastructure & Networking

• Design, deploy, modify, and troubleshoot Azure infrastructure, with networking as a primary area of responsibility.
• Build and maintain virtual networks (VNets), subnets, IP address plans, VNet peering, and hub-and-spoke connectivity.
• Configure and troubleshoot route tables, user-defined routes, effective routes, next-hop behavior, route propagation, and traffic paths through firewalls.
• Support hybrid connectivity, including VPN and ExpressRoute, and diagnose connectivity issues between Azure, on-premises environments, and external services.
• Implement and troubleshoot network security groups, private endpoints, Private Link, private DNS zones, and name resolution across connected environments.
• Validate ingress, egress, and east-west traffic flows, including routing symmetry and inspection requirements.
• Support broader Azure infrastructure needs across compute, storage, managed identities, role-based access control, monitoring, and resource governance.

Cloud Network Security

• Deploy, configure, and troubleshoot Palo Alto Networks Cloud NGFW for Azure and its integration with Azure networking.
• Work with Strata Cloud Manager to manage security policy and support configuration, visibility, and troubleshooting.
• Partner with Information Security and network stakeholders to translate approved security requirements into working configurations.
• Diagnose whether connectivity failures originate in routing, DNS, Azure network controls, firewall policy, or the application.
• Document traffic flows and inspection points, and validate changes through testing, logging, and defined rollback procedures.

Terraform & Engineering Delivery

• Create new Azure resources and modify existing infrastructure using Terraform.
• Import existing resources into Terraform and reconcile configuration with deployed state without unnecessary resource replacement or service disruption.
• Review Terraform plans carefully, resolve drift, manage dependencies, and validate changes before deployment.
• Build and improve reusable modules, using established patterns for remote state, provider configuration, authentication, and environment separation.
• Help transition manually configured infrastructure or existing Bicep deployments into maintainable Terraform where appropriate.
• Deliver changes through version control, pull requests, peer review, and controlled deployment workflows.
• Contribute to GitHub-based automation and deployment pipelines, working with teammates responsible for shared CI/CD capabilities.

Teamwork & Operational Readiness

• Collaborate closely with Engineering, Operations, Information Security, application owners, and vendors.
• Participate in design discussions and code reviews, explain technical trade-offs, and incorporate feedback.
• Take ownership of assigned work while raising dependencies, risks, and blockers early.
• Produce useful network diagrams, implementation notes, test evidence, and support documentation.
• Complete knowledge transfer and an explicit operational handoff so delivered infrastructure can be supported by the internal team.

Required Experience & Capabilities

• Strong hands-on experience implementing and troubleshooting infrastructure in Microsoft Azure.
• Deep practical knowledge of Azure networking, particularly VNets, subnets, peering, routing, route tables, network security groups, private connectivity, and DNS.
• Ability to trace a packet path through an Azure environment and explain how routing decisions and security controls affect connectivity.
• Hands-on experience with Palo Alto Networks cloud network security, including Cloud NGFW for Azure and Strata Cloud Manager.
• Practical Terraform experience covering resource creation, modification, import, state management, and safe change delivery.
• Confidence working with existing infrastructure and code, rather than only building new environments.
• Working knowledge of Git, pull requests, and peer-reviewed engineering workflows.
• A methodical troubleshooting approach, including validation of assumptions and clear documentation of findings.
• Comfort collaborating in a team, asking for context, sharing knowledge, and accepting technical review.
• Ability to deliver within a defined contract period and leave work documented and supportable.

Preferred Experience

• GitHub Enterprise, including repository configuration, permissions, rulesets, GitHub Actions, and self-hosted runners.
• Terraform delivery through automated pipelines, including plan review, approval controls, and secure Azure authentication.
• Azure landing zones, subscription organization, Azure Policy, and infrastructure governance.
• ExpressRoute, BGP, Azure Virtual WAN, or complex hybrid network environments.
• Bicep-to-Terraform migration and adoption of existing resources into infrastructure as code.
• PowerShell, Azure CLI, or Python for troubleshooting and automation.
• Azure Kubernetes Service or Azure Virtual Desktop, particularly their networking and infrastructure dependencies.
• Experience delivering engineering changes in a regulated enterprise.

What Success Looks Like

• Azure infrastructure and network changes work as designed and have clear validation evidence.
• Terraform accurately represents the resources brought under its management, with reviewed plans and controlled changes.
• Routing and firewall behavior are understood, documented, and supportable.
• Work is delivered collaboratively, with maintainable code and a clear handoff to internal owners.