Cloud Engineering Lead (Azure)

Description:

Cloud Engineering Lead (Azure)

6 month contract, scope to extend

£600 - £625 P/D Inside IR35

Hybrid

Active SC would be advantageous

We are looking for a hands-on Cloud Engineering Lead with deep Microsoft Azure expertise to build, run and
productise an enterprise Azure platform. You will turn approved architecture into policy-governed infrastructure
delivered entirely through code and automated pipelines, make sure the platform is reliable and operationally ready,
and treat product teams as customers, giving them a clear, low-friction route onto the platform.

Key responsibilities -

Platform engineering

Lead design and build of Azure Landing Zones: management groups, subscription vending and hub-and-spoke
networking.
Own the provisioning pipelines and a reusable Terraform/Bicep module library built on Azure Verified Modules.
Enforce governance as code (Azure Policy, RBAC/PIM, Defender for Cloud) and integrate ServiceNow to
automate platform requests.
Set engineering quality standards: code reviews, branching and release strategy, pipeline quality gates.
Lead brownfield remediation of existing subscriptions and workloads onto platform standards.Reliability and operations

Define platform SLOs and track service health through observability built on Azure Monitor / Log Analytics,
integrated with Sentinel (Security Operations) and the NOC.
Drive operational readiness and acceptance, with runbooks and documentation in place before handover to Cloud
Run (BAU operations).
Lead resolution of platform incidents, feed root causes into problem management, and reduce toil through
automation as part of continual service improvement.Consumer experience and adoption

Understand the consumer journey and operate the platform "front door": intake, onboarding and the service
catalogue.
Publish paved roads with clear documentation, and run onboarding clinics to drive adoption.
Use feedback and friction analysis to improve the experience, including the AVD / engineering workspace
experience.
Apply the "rule of three": a pattern requested three or more times becomes a productisation candidate for the
catalogue.Mandatory skills & experience

Extensive hands-on Microsoft Azure experience (typically 7+ years in IT, 4+ on Azure) covering design,
architecture and implementation of enterprise platforms.
Proven delivery of Azure Landing Zones / Cloud Adoption Framework: management groups, subscription
vending, hub-and-spoke, Azure Firewall, private DNS and Private Endpoints.
Expert Terraform and Bicep: modular design, state management, testing and versioning; working knowledge of
Azure Verified Modules.
Strong Python (plus PowerShell / Azure CLI) for automation and API integration.
Proven ability to build and maintain multi-stage, approval-gated provisioning pipelines (Azure DevOps and/or
GitHub Actions) with Git-based workflows.
Azure security and governance: Entra ID, RBAC/PIM, managed identities, Key Vault, Azure Policy, Defender for
Cloud.Observability and reliability:

Azure Monitor / Log Analytics, alerting, defining SLOs and service health measures.
Operational readiness: runbooks, incident handling and handover into run/support teams (ITIL-aligned).
Experience leading and mentoring cloud/DevOps engineers in an agile team, including code review and release
practices.Desirable skills & experience

Platform-as-a-product experience: paved roads / golden paths, service catalogue, developer experience and
consumer feedback loops.
ServiceNow integration for self-service provisioning and ITSM (incident, problem, change).
Microsoft Sentinel and integration with SOC / NOC functions.
SRE practices: error budgets, post-incident reviews, toil measurement.
Brownfield remediation or migration of existing Azure estates.
Azure Virtual Desktop (AVD) / Windows 365 workspace experience.
AI and integration platform services: Azure OpenAI / AI Foundry, API Management, Service Bus, Event Grid.
Policy-as-code testing and pipeline security tooling (e.g. PSRule, Checkov, tfsec).
FinOps awareness (tagging, budgets, cost reporting); AKS / container platforms.
Certifications: AZ-305, AZ-400, AZ-104 / AZ-700, HashiCorp Terraform Associate, ITIL 4