Senior Cloud Platform Engineer

Northmark Ltd; Madhya Pradesh; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

NorthMark Strategies is seeking a Senior Cloud Platform Engineer to design and operate governable cloud infrastructure across Azure, AWS, and on‑prem for portfolio companies. You will build shared Terraform modules, enforce policy as code, and drive secure, self‑service environments.

You will participate in on‑call rotations and incident response, turning security findings into preventive controls while documenting runbooks and design docs for engineers and leadership.

Qualifications

• 5+ years building cloud infrastructure in production across Azure or AWS and the other cloud.
• Built Terraform modules used by multiple teams, versioned and maintained.
• Strong networking including private connectivity and hybrid links.
• Identity and access management in both clouds (Entra ID, IAM, SCPs).
• CI/CD for infrastructure, preferably GitHub Actions with OIDC federation.
• Methodical troubleshooting using logs and policy simulations.
• Security-first mindset with least privilege and no secrets in code.
• Proven delivery of infrastructure projects from repo to production.
• Clear writing for engineers, app teams, and leadership.

Responsibilities

• Design and implement scalable cloud infrastructure across Azure and AWS.
• Develop and maintain shared Terraform modules for teams.
• Enforce policy as code and secure defaults for platforms.
• Enable self-service environments via short tfvars inputs.
• Participate in on-call rotations and incident response with security teams.
• Monitor Defender/Cloud security findings and implement preventive controls.
• Document runbooks, design docs, and post-incident write-ups.
• Drive cost tracking and right-sizing for platforms.

Skills

Cloud infrastructure

Terraform modules

Networking

Identity and access management

CI/CD

Security best practices

Incident response

Documentation

Root-cause analysis

Cross-team collaboration

Tools

Terraform

GitHub Actions

Azure

AWS

Entra ID

Job description

NorthMark Strategies is a leading investment firm, combining capital, innovation, and engineering to drive long-term value. From operating complex businesses to backing breakthrough technologies, our mission is to build enduring businesses. Our team combines intelligent risk-taking, operational excellence, exceptional talent, and world‑class computing capacity to create shareholder value.

Our company offers a dynamic environment where individuals have the freedom to lead companies toward bold achievements by embracing innovation, leveraging technology, and fostering differentiated business strategies. Our values are Integrity, Ability, and Energy, and the company aims to hire individuals who possess those qualities.

At NorthMark Strategies, we believe the future isn't something to hope for, it's something to build. We don't just invest, we create. Bringing together strategic insight and technical horsepower to deliver outcomes that endure.

The Position

We run governed infrastructure across Azure, AWS, and on‑prem for multiple portfolio companies. We want a Senior Cloud Platform Engineer who works as a peer on the platform. You'll work from design through production, troubleshoot hard problems without help, and raise our bar for automation, security, and documentation.

What you will build

• Paved roads
• Shared Terraform modules that teams use to get their environments: networking, storage, identity, compute, secrets, and monitoring, with secure defaults built in.
• Versioned, tested, documented modules, so a team can move to a new version without asking us.
• Policy as code (Azure Policy, conftest, SCPs and RCPs) that catches problems at plan time, not after apply.
• Self‑service: a team fills in a short tfvars file and gets a working, compliant environment.

Projects

• Platform projects, from design to production, with the architect. A current example is a secure platform that shares petabyte‑scale data with our portfolio companies across Azure, AWS, and on‑prem.
• Infrastructure for the teams we serve: GPU capacity for machine learning, remote workspaces, and hybrid connectivity to the datacenter.
• Proofs of concept that settle a design question quickly, with real numbers. This includes judging which new cloud features are worth adopting.

The platform itself

• Landing zones and guardrails: management groups and subscriptions in Azure; Organizations, OUs (organizational units), SCPs, RCPs, and account vending in AWS.
• Networking: hub‑and‑spoke and Transit Gateway, firewalls, private endpoints and VPC endpoints, DNS, ExpressRoute, Direct Connect, and VPN.
• Identity: Entra ID, managed identities, IAM Identity Center permission sets, cross‑account roles, and workload identity federation (OIDC). No stored secrets or long‑lived keys where federation is possible.
• CI/CD for infrastructure: GitHub Actions with OIDC, self‑hosted runners, and plan review in every pull request.

What you will also run

• Builders run what they build. You take part in:
• the on‑call rotation for the platform, with the security team for incidents
• escalations that cross identity, networking, and pipelines: find the root cause, fix it, and write it up so it doesn't come back
• findings from Defender for Cloud, Security Hub, GuardDuty, and Access Analyzer, turned into preventive controls rather than one‑off fixes
• monitoring and alerting for what you ship, so that every alert has an owner
• cost tracking for your projects, with right‑sizing when the numbers say so
• runbooks, so someone else can operate what you built
• We would rather you automate an operational task than do it twice.

Must have

• 5 or more years building cloud infrastructure in production. Deep experience in Azure or AWS, and solid working experience in the other.
• You have built Terraform modules that other teams used. You can talk about how you versioned, tested, and released them, and what you would do differently. You are comfortable with imports, state moves, and refactors on live infrastructure.
• Strong networking: routing, DNS, private connectivity, firewalls, and hybrid links (ExpressRoute or Direct Connect, and VPN).
• Identity and access in both clouds. Azure: Entra ID, RBAC (role‑based access control), managed identities, and private‑only service design. AWS: how IAM policies are evaluated, SCPs, permission boundaries, cross‑account trust, and STS.
• CI/CD for infrastructure, preferably GitHub Actions with OIDC federation.
• Methodical troubleshooting using the evidence: Activity Log, CloudTrail, flow logs, and policy simulation, until you find the root cause.
• Security‑first habits: least privilege, no secrets in code, logging, and audit by default.
• Careful production habits: you check before you change or delete, plan the rollback, and document as you go.
• You have taken at least one infrastructure project from an empty repo to production.
• Clear writing for engineers, app teams, and leadership: design docs, runbooks, and post‑incident write‑ups.

Nice to have

• Module testing and policy tools: Terr