Azure Cloud Engineer / Principal Cloud Architect

Secure, Event-Driven, Serverless Platforms on Microsoft Azure — IaC, Identity, Networking, and Operations

Role Summary

We are looking for an engineer who can design, build, operate, and evolve secure, scalable, and reliable solutions on Microsoft Azure — and who understands the platform deeply enough to be the escalation point when it breaks at 2 a.m. and the architect when the org decides what to build next.

This is not a "click in the portal" role and not a "run one Terraform module" role. It is about owning the cloud platform layer itself: the Infrastructure-as-Code that provisions everything, the identity fabric (Microsoft Entra ID) that authenticates and authorizes every call, the landing zones and governance that hundreds of engineers deploy into, the networking substrate that isolates and connects workloads, the event-driven and serverless application patterns the business runs on, and the observability and operational playbooks that keep it all available, secure, and fast.

The reference responsibilities (verbatim from the requisition):

  1. Provide troubleshooting and operational support for Azure cloud services and infrastructure.
  2. Design, implement, and maintain Infrastructure as Code (IaC) solutions using Terraform, HashiCorp CDKTF, and ARM Templates.
  3. Configure and manage Azure Landing Zones, Microsoft Entra ID (Azure AD), Azure Policies, RBAC, networking, and identity integrations.
  4. Build, deploy, and manage containerized applications using Docker and Azure Container Registry (ACR).
  5. Develop and maintain CI/CD pipelines to automate application builds, testing, and deployments.
  6. Develop and integrate RESTful APIs using JSON and implement secure authentication and authorization mechanisms (OAuth2, OpenID Connect).
  7. Design and implement event-driven architectures using Azure Event Grid, Azure Service Bus, and Azure Logic Apps.
  8. Integrate serverless applications with Azure security services, including Azure Key Vault, Managed Identities, and Microsoft Entra ID.
  9. Monitor, troubleshoot, and optimize cloud infrastructure to ensure high availability, security, and performance.
  10. Collaborate with cross-functional teams to deliver secure, scalable, and reliable cloud solutions.

What "Principal-Level" Means Here

A senior engineer uses these services correctly. A principal understands them under the hood — well enough to predict failure, defend a design with numbers, and debug across every layer of the stack:

  • Control plane vs data plane. You know that every Azure write goes through Azure Resource Manager (ARM) as an idempotent PUT against a resource provider, that the deployment engine builds a dependency graph from dependsOn and implicit references, and that the data plane (the blob you read, the message you receive, the secret you fetch) is a different system with different identity, throttling, and SLA.
  • Identity is the new perimeter. You can draw the OAuth2 authorization-code+PKCE flow and the client-credentials flow from memory, validate a JWT's iss/aud/exp/scp claims by hand, explain how a Managed Identity acquires a token from IMDS with no secret, and reason about RBAC evaluation (role assignments, NotActions, deny assignments, scope inheritance) and Azure Policy effects as code.
  • Networking is software-defined. You can evaluate an NSG rule set in priority order, compute effective routes with longest-prefix matching across system/UDR/BGP routes, and explain why a Private Endpoint changes DNS resolution and how that breaks (and fixes) connectivity.
  • Events and serverless are distributed systems. You know Service Bus peek-lock, sessions, duplicate detection, and dead-lettering; Event Grid's at-least-once delivery with exponential-backoff retry; the Functions scale controller; and Durable Functions' event-sourced, replay-based determinism.
  • Reliability and cost are quantitative. You compose SLAs (serial vs redundant), size retries with backoff + jitter and a retry budget, run a circuit breaker, honor 429 / Retry-After, and put numbers on availability zones, paired regions, and the monthly bill before anyone asks.

The Stack You Will Master

ARM / Bicep / Azure Resource Manager   Terraform (AzureRM provider) / CDKTF
Microsoft Entra ID (Azure AD)          OAuth2 / OIDC / JWT / Conditional Access
RBAC / Azure Policy / Management Groups Cloud Adoption Framework / Landing Zones
VNet / NSG / UDR / Private Link / DNS   Azure Firewall / ExpressRoute / Front Door
Docker / ACR / AKS / Container Apps     Azure DevOps / GitHub Actions / OIDC federation
API Management / REST / JSON            Key Vault / Managed Identities / IMDS
Event Grid / Service Bus / Logic Apps   Azure Functions / Durable Functions
Azure Monitor / Log Analytics / KQL     Application Insights / distributed tracing
Availability Zones / paired regions     Well-Architected Framework / FinOps

What Success Looks Like

You are the person who can architect an Azure platform at the system level and debug it at the token, route table, manifest digest, message lock, checkpoint, and KQL-query level — and who leaves behind landing zones, IaC, policy-as-code, and runbooks that let hundreds of other engineers ship securely without reinventing the platform.

Everything in this curriculum is built, not just described: you implement working, test-verified miniatures of ARM's deployment graph, Terraform's plan engine, the OAuth2 token flows, the RBAC/Policy evaluator, the NSG/route engine, an OCI registry, a CI/CD DAG, an API gateway, a Service Bus broker, the Functions runtime, Key Vault envelope encryption, a KQL engine, and the reliability primitives — so the mechanisms become muscle memory instead of folklore.