Cloud Engineering Lead (Azure)

Cloud Engineering Lead (Azure)

6 month contract, scope to extend

Active SC would be advantageous

We are looking for a hands-on Cloud Engineering Lead with deep Microsoft Azure expertise to build, run and productise an enterprise Azure platform. You will turn approved architecture into policy-governed infrastructure delivered entirely through code and automated pipelines, make sure the platform is reliable and operationally ready, and treat product teams as customers, giving them a clear, low-friction route onto the platform.

Platform engineering

• Lead design and build of Azure Landing Zones: management groups, subscription vending and hub-and-spoke networking.
• Own the provisioning pipelines and a reusable Terraform/Bicep module library built on Azure Verified Modules.
• Enforce governance as code (Azure Policy, RBAC/PIM, Defender for Cloud) and integrate ServiceNow to automate platform requests.
• Set engineering quality standards: code reviews, branching and release strategy, pipeline quality gates.
• Lead brownfield remediation of existing subscriptions and workloads onto platform standards.

Reliability and operations

• Define platform SLOs and track service health through observability built on Azure Monitor/Log Analytics, integrated with Sentinel (Security Operations) and the NOC.
• Drive operational readiness and acceptance, with runbooks and documentation in place before handover to Cloud Run (BAU operations).
• Lead resolution of platform incidents, feed root causes into problem management, and reduce toil through automation as part of continual service improvement.

Consumer experience and adoption

• Understand the consumer journey and operate the platform "front door": intake, onboarding and the service catalogue.
• Publish paved roads with clear documentation, and run onboarding clinics to drive adoption.
• Use feedback and friction analysis to improve the experience, including the AVD/engineering workspace experience.
• Apply the "rule of three": a pattern requested three or more times becomes a productisation candidate for the catalogue.

Mandatory skills & experience

• Extensive hands-on Microsoft Azure experience (typically 7+ years in IT, 4+ on Azure) covering design, architecture and implementation of enterprise platforms.
• Proven delivery of Azure Landing Zones/Cloud Adoption Framework: management groups, subscription vending, hub-and-spoke, Azure Firewall, private DNS and Private Endpoints.
• Expert Terraform and Bicep: modular design, state management, testing and versioning; working knowledge of Azure Verified Modules.
• Strong Python (plus PowerShell/Azure CLI) for automation and API integration.
• Proven ability to build and maintain multi-stage, approval-gated provisioning pipelines (Azure DevOps and/or GitHub Actions) with Git-based workflows.
• Azure security and governance: Entra ID, RBAC/PIM, managed identities, Key Vault, Azure Policy, Defender for Cloud.

Observability and reliability:

• Azure Monitor/Log Analytics, alerting, defining SLOs and service health measures.
• Operational readiness: runbooks, incident handling and handover into run/support teams (ITIL-aligned).
• Experience leading and mentoring cloud/DevOps engineers in an agile team, including code review and release practices.

Desirable skills & experience

• Platform-as-a-product experience: paved roads/golden paths, service catalogue, developer experience and consumer feedback loops.
• ServiceNow integration for self-service provisioning and ITSM (incident, problem, change).
• Microsoft Sentinel and integration with SOC/NOC functions.
• SRE practices: error budgets, post-incident reviews, toil measurement.
• Brownfield remediation or migration of existing Azure estates.
• Azure Virtual Desktop (AVD)/Windows 365 workspace experience.
• AI and integration platform services: Azure OpenAI/AI Foundry, API Management, Service Bus, Event Grid.
• Policy-as-code testing and pipeline security tooling (eg PSRule, Checkov, tfsec).
• FinOps awareness (tagging, budgets, cost reporting); AKS/container platforms.
• Certifications: AZ-305, AZ-400, AZ-104/AZ-700, HashiCorp Terraform Associate, ITIL 4.