L3 Cloud Infrastructure Engineer

The engineer is the escalation point for L2 on infrastructure issues, executes UAT and production releases through GitHub Actions and Terraform, and is accountable for the stability, security, and capacity of the platform's Azure estate: API Management, Azure Front Door/WAF, Container Apps, Service Bus, storage, and Azure OpenAI deployments.

Key responsibilities

Release and deployment operations

• Execute Workbench and aIQ Chat UAT and production deployments across AMER, EMEA, and ASPAC using GitHub Actions workflows and Terraform.
• Own the full deployment runbook end to end, including steps that require elevated Azure tenant permissions (no hand-offs to other teams for privileged steps).
• Raise and manage ServiceNow change requests, present production changes at CAB, and attach evidence of each successful pipeline run.
• Validate the correct branch, tag, and ref before every run; maintain pre-flight checklists and rollback plans for every release.
• Coordinate release windows with Product, QA, and L2 (who perform post-deployment smoke testing on model packs).
• Perform scheduled weekend production deployments.

Infrastructure engineering and operations

• Operate and harden Azure API Management hubs, Azure Front Door with WAF policies, Azure Container Apps, Function Apps, Service Bus, ADLS/Blob storage, Azure SQL, Cosmos DB for MongoDB vCore, Key Vault, and private networking (VNets, private endpoints, private DNS).
• Provision and retire Azure OpenAI and partner model deployments (including PTU/provisioned throughput) across regions, and manage quota and capacity.
• Maintain Terraform modules and state; detect and remediate configuration drift.
• Tune scaling (min/max replicas, autoscale rules, timeouts) for proxy and API container apps based on load data.
• Manage DNS, certificates, and custom domains, including cleanup of stale or dangling records.

L3 escalation and incident management

• Act as the escalation point for L2 App Support on infrastructure-level incidents (5xx errors, timeouts, TLS failures, queue quota exhaustion, WAF false positives, private endpoint and firewall issues).
• Lead root cause analysis and write RCAs with corrective actions, not just restorations.
• Open and drive Microsoft and Google support cases to resolution.

Security, compliance, and governance

• Remediate Defender for Cloud and vulnerability findings within SLA (public network access, unauthenticated APIs, Conditional Access impacts on service principals).
• Manage app registrations, managed identities, and secret/certificate rotation; own expiry alerting.
• Enforce least-privilege RBAC and PIM; support access reviews and audit evidence requests.
• Configure storage lifecycle and retention policies safely, with change review before any deletion rule goes live.

Observability, cost, and automation

• Build and maintain Azure Monitor, Log Analytics, and Application Insights alerts and dashboards for availability, latency, and error rates per region.
• Monitor Azure cost anomalies and support consumption-based chargeback reporting.
• Automate repetitive operational work (onboarding, key provisioning, inventory exports) with PowerShell, Python, Azure CLI, and GitHub Actions.
• Maintain disaster recovery documentation and run DR and restore tests.
• Write and keep current runbooks and KB articles so L2 can resolve more issues without escalation.

Required qualifications

• 6+ years in cloud infrastructure or platform engineering, with at least 4 years hands-on in Microsoft Azure production environments.
• Production experience operating Azure API Management (policies, backends, products/subscriptions, multi-region or hub topology).
• Hands-on Azure Front Door and WAF: custom rules, managed rule sets, exclusions, and tuning false positives.
• Azure networking depth: VNets, NSGs, private endpoints, private DNS zones, service endpoints, firewall allowlisting, and TLS troubleshooting.
• Terraform in production: module design, remote state, plan review, drift remediation, and imports.
• CI/CD with GitHub Actions (preferred) or Azure DevOps, including environment approvals, OIDC/federated credentials, and tag/ref-based releases.
• Container platforms: Azure Container Apps or AKS, including scaling rules, revisions, ingress, and diagnosing 502/504 behavior.
• Entra ID administration for workloads: app registrations, service principals, managed identities, RBAC, PIM, and Conditional Access impacts.
• Scripting in PowerShell and Python, plus Azure CLI.
• Working knowledge of ITIL change and incident management in ServiceNow (CRs, CAB, RCAs).
• Proven ability to lead an incident bridge and write a clear RCA for technical and non-technical audiences.
• Availability for scheduled weekend production deployments and an on-call rotation.

Preferred qualifications

• Experience operating Azure OpenAI or Azure AI Foundry: model deployments, quotas, PTU, model retirements, and regional availability.
• Exposure to Google Cloud Platform (Vertex AI, networking) or AWS in a multi-cloud integration context.
• Azure Service Bus, Event Grid, and Function Apps at production scale (dead-letter handling, quota limits).
• Cosmos DB (MongoDB vCore) and Azure SQL operations.
• Observability with Azure Monitor, Log Analytics (KQL), and Application Insights; Grafana or Power BI a plus.
• FinOps practice: cost anomaly investigation, reservations, and showback/chargeback.
• Microsoft Defender for Cloud and vulnerability remediation in a regulated, multi-tenant enterprise.
• Experience in professional services, financial services, or another environment with strict change control and data residency rules.

Certifications (any of the following)

• Microsoft Certified: Azure Administrator Associate (AZ-104)
• Microsoft Certified: Azure Solutions Architect Expert (AZ-305)
• Microsoft Certified: DevOps Engineer Expert (AZ-400)
• Microsoft Certified: Azure Network Engineer Associate (AZ-700)
• HashiCorp Certified: Terraform Associate

Certifications are a plus, not a substitute for demonstrated production experience

Strong signals

• Has operated APIM and Front Door/WAF in production, not just deployed them once
• Uses Terraform and GitHub Actions daily, and can describe a drift or failed-apply recovery
• Has led incident bridges and written RCAs
• Comfortable with weekend change windows and on-call

Ongoing measures

• Change success rate for production deployments (target 95%+ with no unplanned rollback)
• Zero deployments run against the wrong branch, tag, or environment
• Mean time to resolve L3 escalations, and the number of escalations converted into L2 runbooks
• Security and vulnerability findings closed within SLA
• Platform availability and p95 latency per region against target

Cost anomalies investigated within one business day

Working conditions

• Production deployments typically run in scheduled weekend windows; the engineer must be available for these on a planned rotation.
• Participates in an on-call rotation for L3 infrastructure escalations supporting a 24/7 global platform.
• Works across time zones with teams in the US, India, Australia, and Europe; some early-morning or evening meetings are expected.
• Role requires elevated Azure tenant and subscription permissions, granted through PIM after background and access approval.

Location, level, and compensation: open, to be confirmed with the hiring manager