Cloud Engineering Lead (Azure)

TXP; City Of London; Hybrid; GBP 111,000 - 115,000; Part time

Job summary

TXP is seeking a hands-on Cloud Engineering Lead with deep Microsoft Azure expertise to build, run, and productise an enterprise Azure platform.

You will turn approved architecture into policy-governed infrastructure, ensure reliability, and treat product teams as customers with a low-friction path to the platform.

Qualifications

• Extensive hands-on Microsoft Azure experience (7+ years IT, 4+ on Azure) covering enterprise platforms.
• Proven delivery of Azure Landing Zones / Cloud Adoption Framework components.
• Expert in modular Terraform and Bicep design with state management and testing.
• Strong Python for automation and API integration.

Responsibilities

• Lead design and build of Azure Landing Zones, including hub-and-spoke networking.
• Own provisioning pipelines and a reusable Terraform/Bicep module library.
• Enforce governance as code with Azure Policy, RBAC/PIM and Defender for Cloud.
• Define platform SLOs and track health using Azure Monitor and Log Analytics.

Skills

Azure

Azure Landing Zones

Terraform

Bicep

Python

Azure DevOps

GitHub Actions

Azure Policy

RBAC / PIM

Azure Monitor

Tools

Terraform

Bicep

Azure DevOps

GitHub Actions

PowerShell

Azure CLI

Job description

Cloud Engineering Lead (Azure)

6 month contract, scope to extend

£600 - £625 P/D Inside IR35

Hybrid

Active SC would be advantageous

We are looking for a hands‑on Cloud Engineering Lead with deep Microsoft Azure expertise to build, run and productise an enterprise Azure platform. You will turn approved architecture into policy-governed infrastructure delivered entirely through code and automated pipelines, make sure the platform is reliable and operationally ready, and treat product teams as customers, giving them a clear, low‑friction route onto the platform.

Key responsibilities -

Platform engineering

• Lead design and build of Azure Landing Zones: management groups, subscription vending and hub-and-spoke networking.
• Own the provisioning pipelines and a reusable Terraform/Bicep module library built on Azure Verified Modules.
• Enforce governance as code (Azure Policy, RBAC/PIM, Defender for Cloud) and integrate ServiceNow to automate platform requests.
• Set engineering quality standards: code reviews, branching and release strategy, pipeline quality gates.
• Lead brownfield remediation of existing subscriptions and workloads onto platform standards.

Reliability and operations

• Define platform SLOs and track service health through observability built on Azure Monitor / Log Analytics, integrated with Sentinel (Security Operations) and the NOC.
• Drive operational readiness and acceptance, with runbooks and documentation in place before handover to Cloud Run (BAU operations).
• Lead resolution of platform incidents, feed root causes into problem management, and reduce toil through automation as part of continual service improvement.

Consumer experience and adoption

• Understand the consumer journey and operate the platform "front door": intake, onboarding and the service catalogue.
• Publish paved roads with clear documentation, and run onboarding clinics to drive adoption.
• Use feedback and friction analysis to improve the experience, including the AVD / engineering workspace experience.
• Apply the "rule of three": a pattern requested three or more times becomes a productisation candidate for the catalogue.

Mandatory skills & experience

• Extensive hands‑on Microsoft Azure experience (typically 7+ years in IT, 4+ on Azure) covering design, architecture and implementation of enterprise platforms.
• Proven delivery of Azure Landing Zones / Cloud Adoption Framework: management groups, subscription vending, hub-and-spoke, Azure Firewall, private DNS and Private Endpoints.
• Expert Terraform and Bicep: modular design, state management, testing and versioning; working knowledge of Azure Verified Modules.
• Strong Python (plus PowerShell / Azure CLI) for automation and API integration.
• Proven ability to build and maintain multi‑stage, approval‑gated provisioning pipelines (Azure DevOps and/or GitHub Actions) with Git‑based workflows.
• Azure security and governance: Entra ID, RBAC/PIM, managed identities, Key Vault, Azure Policy, Defender for Cloud.
• Observability and reliability: Azure Monitor / Log Analytics, alerting, defining SLOs and service health measures.
• Operational readiness: runbooks, incident handling and handover into run/support teams (ITIL‑aligned).
• Experience leading and mentoring cloud/DevOps engineers in an agile team, including code review and release practices.

Desirable skills & experience

• Platform-as-a-product experience: paved roads / golden paths, service catalogue, developer experience and consumer feedback loops.
• ServiceNow integration for self‑service provisioning and ITSM (incident, problem, change).
• Microsoft Sentinel and integration with SOC / NOC functions.
• SRE practices: error budgets, post‑incident reviews, toil measurement.
• Brownfield remediation or migration of existing Azure estates.
• Azure Virtual Desktop (AVD) / Windows 365 workspace experience.
• AI and integration platform services: Azure OpenAI / AI Foundry, API Management, Service Bus, Event Grid.
• Policy-as-code testing and pipeline security tooling (e.g. PSRule, Checkov, tfsec).
• FinOps awareness (tagging, budgets, cost reporting); AKS / container platforms.
• Certifications: AZ-305, AZ-400, AZ-104 / AZ-700, HashiCorp Terraform Associate, ITIL 4