Azure Infrastructure Engineer

CoffeeBeans; Bengaluru Urban; Presencial; INR 3.000.000 - 5.200.000; Jornada completa

Descripción de la vacante

CoffeeBeans is seeking an experienced Infrastructure Developer to design and automate enterprise Azure cloud environments. You will implement robust security baselines with Microsoft Defender for Cloud, manage network RBAC and segmentation, and drive full lifecycle deployment automation using IaC.

You will build resilient architectures, harden AKS clusters, and ensure continuous delivery via GitLab CI/CD while coordinating with security and operations teams across hybrid environments.

Formación

• 5+ years hands-on Azure cloud infrastructure experience.
• Experience designing scalable, highly available Azure networks.
• Proven ability to implement secure baseline configurations and CSPM/CWPP controls.
• Hands-on automation of provisioning and deployments using IaC.

Responsabilidades

• Design, build, and maintain scalable Azure cloud infrastructure using IaC.
• Configure Azure Defender, CSPM, and CWPP to enforce security baselines.
• Implement RBAC, Entra ID, and network segmentation across environments.
• Develop CI/CD pipelines (GitLab) for automated provisioning, testing, and deployment.
• Harden AKS clusters and manage container image security and vulnerability scanning.

Conocimientos

Azure Architecture

Azure RBAC

Infrastructure as Code

CI/CD with GitLab

AKS & container security

Networking design

Security baselines

Herramientas

Terraform

Bicep/ARM

GitLab CI/CD

Azure Defender

Descripción del empleo

We are looking for an experienced Infrastructure Developer to design, automate, and maintain enterprise-grade cloud environments on Microsoft Azure. In this role, you will bridge the gap between software development and systems engineering by building resilient, self-healing Infrastructure as Code (IaC). You will be directly responsible for establishing robust security baselines using Microsoft Defender for Cloud (Azure Defender), implementing granular Network RBAC and segmentation policies, and driving full lifecycle deployment automation across all cloud environments.

Key Responsibilities

• Cloud Infrastructure Architecture & Provisioning: Design, build, and maintain highly available, scalable Azure cloud infrastructure using Infrastructure as Code (IaC) principles to eliminate manual provisioning and configuration drift.
• Security & Threat Mitigation (Azure Defender): Configure, tune, and manage Microsoft Defender for Cloud (Azure Defender) across compute, storage, databases, and container workloads. Continuously monitor Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWPP), remediating findings and enforcing compliance benchmarks.
• Network RBAC & Access Engineering: Design and enforce least-privilege access models using Azure Role-Based Access Control (RBAC), Azure AD/Entra ID, and Privileged Identity Management (PIM). Implement network segmentation, Network Security Groups (NSGs), Application Security Groups (ASGs), Route Tables, and Azure Firewall policies to govern east-west and north-south traffic securely.
• End-to-End Automation: Build, optimize, and maintain CI/CD pipelines (e.g., GitLab CI) to automate infrastructure provisioning, configuration management, application deployment, and compliance testing.
• Container Orchestration & Platform Engineering: Deploy, manage, and harden container ecosystems (primarily Azure Kubernetes Service - AKS) with a focus on network policies, private clusters, and container image vulnerability scanning via Defender for Containers.
• Observability as Code: Define and implement monitoring, logging, and alerting frameworks across hybrid/cloud workloads using Azure Monitor, Log Analytics (KQL), Prometheus, and Grafana to proactively detect degradation and auto-remediate known failure modes.
• Architectural Hardening & Reliability: Act as the Tier-3 escalation authority for critical infrastructure and network incidents. Participate in postmortems and convert root-cause findings into automated preventative controls and resilient architectural improvements.
• Technical Standards & Blueprints: Author reusable IaC modules, technical architecture diagrams, and operational engineering standards for development and operations teams.

Must-Have Requirements

• Azure Cloud Architecture & Core Networking: 5+ years of hands-on experience provisioning and supporting Azure environments, including Virtual Networks (VNets), subnets, Route Tables (UDRs), peering, Private Endpoints, and private DNS zones.
• Security & Azure Defender: Practical experience deploying, configuring, and tuning Microsoft Defender for Cloud (Azure Defender) across servers, storage, databases, and container workloads, including CSPM posture tuning and CWPP threat alert remediation.
• Network RBAC & Identity Governance: Strong expertise in designing and enforcing least-privilege access using Azure Role-Based Access Control (RBAC), custom role definitions, scope hierarchies (Management Groups down to Resource Groups), and Entra ID/Azure AD controls.
• GitLab CI/CD Pipeline Automation: Production experience building, optimizing, and maintaining automated CI/CD pipelines using GitLab CI/CD for infrastructure provisioning, container image builds, and application releases.
• PostgreSQL Database Optimization & Operations: Proven experience administering and tuning Azure Database for PostgreSQL (Flexible Server), including query performance tuning, index optimization, connection pooling (PgBouncer), compute/storage IOPS sizing, high-availability setups, and automated backup/recovery.
• Infrastructure Upgrades & Patching: Hands-on experience planning and executing zero-downtime platform upgrades, OS patching, database version upgrades, TLS certificate rotations, and runtime deprecation cycles.
• Infrastructure as Code (IaC) & Scripting: Strong proficiency writing modular, production-ready code in Terraform or Bicep/ARM, paired with scripting skills in Bash or Python to automate administrative operations.
• Containerization: Hands-on experience managing and securing containerized workloads, with a focus on Azure Kubernetes Service (AKS), node pool lifecycle management, and container security.
• Stakeholder Engagement & Communication: Track record of communicating infrastructure requirements clearly to both technical teams and client/executive stakeholders, including leading architectural reviews and post-incident reviews.

Should-Have Requirements

• Azure Landing Zones: Familiarity with the Microsoft Cloud Adoption Framework (CAF) and experience architecting enterprise-scale Landing Zones with scalable management group structures and policy-driven governance.
• Azure Virtual WAN (vWAN): Working knowledge of architecting and operating large-scale transit networks using Azure Virtual WAN to connect distributed spokes, VPNs, and ExpressRoute circuits.
• Azure Firewall & Perimeter Defense: Experience managing native network security appliances, including Azure Firewall (Standard/Premium), Firewall Manager policies, and Application Gateway / Web Application Firewall (WAF) rule sets.
• Regulatory Compliance Frameworks: Experience enforcing and auditing security baselines against industry frameworks (e.g., CIS Azure Benchmarks, NIST SP 800-53, ISO 27001, SOC 2) using Azure Policy and Defender compliance dashboards.
• Third-Party Observability: Experience instrumenting hybrid observability platforms (e.g., Datadog, Prometheus/Grafana, Splunk) alongside Azure Monitor and Log Analytics (KQL) for distributed tracing and alerting.