Cloud Platform Engineer (Azure)

Bespin Global MEA, an e& enterprise company; Abu Dhabi; On-site; AED 480,000 - 720,000; Full time

Job summary

Bespin Global MEA, an e& enterprise company, is seeking a senior Cloud Infrastructure Engineer to design, implement, and operate secure Azure cloud infrastructure for enterprise platforms and AI workloads. You will apply an end-to-end engineering approach with IaC, deployment automation, validation, and ongoing operations to ensure reliability, security, and continuous improvement.

Responsibilities include building the landing zone, migrations, identity engineering, observability, security

Qualifications

• 7+ years in infrastructure or platform engineering.
• 3+ years hands-on Azure at enterprise scale.
• Infrastructure as code as default working mode.
• Strong scripting and networking expertise.

Responsibilities

• Build the landing zone with spoke networks, firewall policy, private DNS, and app gateway resources using Bicep and Azure DevOps pipelines.
• Execute migrations including database moves, data transfers, cutovers, and rollback planning.
• Engineer identity and access using Entra ID, PIM, and entitlement management as code.
• Keep observability and operability with Log Analytics, Grafana, alerts, and runbooks.
• Enforce security line with private endpoints, forced-tunnel egress, and Azure Policy guardrails.
• Operate what you build: incident triage, change reviews, and documentation.
• Experience with IaC, Terraform acceptable, and avoid portal changes; strong Git workflows.
• Deep Azure networking (hub-spoke, Firewalls, UDRs, VPN/ExpressRoute, App Gateway/WAF).
• Scripting fluency: PowerShell required; Python a plus; REST APIs helpful.
• Migration program experience including datacenter-to-cloud or tenant-to-tenant moves.
• SQL Server awareness for migrations and availability groups; not DBA depth.
• Clear written communication in PRs, design docs, and runbooks.

Skills

Azure

Bicep

PowerShell

Python

Entra ID

SAML/OIDC

RBAC

Azure DevOps

GitHub pipelines

Networking

Tools

Terraform

GitHub

Azure DevOps

Job description

The role is responsible for designing, implementing, and operating secure and scalable Azure cloud infrastructure supporting enterprise platforms and AI workloads. The position follows an end-to-end engineering approach, covering infrastructure-as-code, deployment automation, validation, and ongoing operations, while ensuring platform reliability, security, and continuous improvement.

Job Accountabilities:

Build the landing zone: design and deliver spoke networks, firewall policy, private DNS, ingress (App Gateway/WAF), and shared platform services in Bicep, deployed through Azure DevOps pipelines with deployment stacks and evidence gates.

Execute migrations: plan and run application migration waves - fresh-build targets, SQL Server database moves (backup/restore, log shipping, AlwaysOn AGs on Azure VMs), file-share and data transfers over controlled paths, cutovers with parallel-run and rollback plans.

Engineer identity and access: Entra ID authentication (SSO/SAML for onboarded entities), PIM based just-in-time access models, managed identities everywhere, entitlement management as code.

Keep it observable and operable: diagnostic settings, Log Analytics, Grafana dashboards, alert rules, smoke-test pipelines, and operational runbooks as part of every deliverable - not as an afterthought.

Hold the security line: private-endpoints-only PaaS, forced-tunnel egress through central firewall, zero-trust access from managed Cloud PCs, Azure Policy guardrails - and the discipline to work within them (and improve them) rather than around them.

Operate what you build: triage platform incidents using firewall logs, KQL, and activity logs; participate in change reviews; document designs and procedures in the team's standards structure.

Job Specification:

7+ years in infrastructure or platform engineering, with 3+ years hands on Azure at enterprise scale.

Infrastructure as code as your default working mode - Bicep strongly preferred (Terraform acceptable), Git branching/PR workflows, Azure DevOps or GitHub pipelines. You should be uncomfortable making portal changes.

Deep Azure networking: hub-and-spoke, Azure Firewall rules and policy, UDRs, private endpoints and Private DNS, VPN/ExpressRoute, Application Gateway/WAF.

Identity engineering: Entra ID, SAML/OIDC federation, PIM, RBAC design, managed identities, Microsoft Graph scripting.

Scripting fluency: PowerShell required; Python a plus. Comfortable with REST APIs when the CLI falls short.

Migration experience: at least one substantial datacenter-to-cloud or tenant-to-tenant migration programme, including database moves and cutover planning.

Working SQL Server knowledge (senior roles): backup/restore mechanics, authentication models, availability groups - enough to move and stand up databases confidently, not DBA depth.

Clear written communication: PR descriptions, design docs, and runbooks are first-class deliverables in this team.