Lead Cloud Infrastructure Engineer (Azure+AWS)

Creative Chaos; Pakistan; On-site; PKR 2,000,000 - 4,000,000; Full time

Job summary

Creative Chaos is seeking a Lead Infrastructure & Cloud Engineer with a strong Wintel foundation and hands-on cloud expertise across Azure (primary) and AWS. You will define modern cloud standards, guide technical direction, and uplift the team, acting as a technical authority for infrastructure and hybrid cloud initiatives.

You’ll lead the creation of reference designs, guardrails, and architecture artefacts, while coordinating across security, DevOps, and software teams to drive reliable,

Qualifications

• Strong enterprise infrastructure background with a Wintel core.
• Hands-on Azure production experience including identity/RBAC/Entra integration and networking.
• Working knowledge of AWS production environments and CloudWatch.

Responsibilities

• Own the target-state hybrid cloud architecture roadmap (12-24 months).
• Define reference architectures, standards, landing zones, and guardrails for security, resilience and cost.
• Lead design and implementation of secure cloud networking (VNets/VPN/ExpressRoute/Private Link).
• Own cloud governance foundations: subscriptions/accounts, tagging, logging, and policy guardrails.
• Establish platform observability and FinOps discipline for cost ownership and optimization.

Skills

Wintel infrastructure

Azure production

Azure RBAC/Entra

VNets/VPN/ExpressRoute

Cloud governance

PowerShell scripting

Architecture artefacts

OpenTelemetry

FinOps / cost management

Tools

PowerShell

Bash

Python

Terraform

Bicep

Azure CLI

Job description

Job Summary:

We are hiring a Lead Infrastructure & Cloud Engineer with a strong Wintel infrastructure foundation and current, hands‑on capability in modern cloud infrastructure across Azure (primary) and AWS. This role exists to close a capability gap: we have deep on‑prem expertise, and we need a leader who can define and drive modern cloud standards, guide technical direction, and uplift the team.

You’ll operate as a technical lead with an architecture mindset: creating reference designs, setting guardrails, making pragmatic trade‑offs (security, resilience, cost), and leading delivery across infrastructure and hybrid cloud. This is not a DevOps role, you will collaborate with DevOps and engineers, but your focus is infrastructure/platform, governance, reliability, and technical leadership.

Job Responsibilities:

Cloud & Hybrid Architecture (Azure & AWS)

• Own the target‑state hybrid cloud architecture and roadmap (12-24 months), aligning security, resilience, and cost requirements.
• Define reference architectures and standards: landing zones, network patterns, identity patterns, logging/monitoring, backup/DR, and environment separation.
• Lead design and implementation of secure cloud networking: VNets/VPCs, routing, VPN, ExpressRoute/Direct Connect, Private Link/Endpoints, load balancers, WAF where needed.
• Own cloud governance foundations: subscriptions/accounts, management groups, RBAC, naming/tagging, logging, budgets and policy guardrails.

Modern Cloud Operations (Hands-on Leadership)

• Ensure cloud platforms, services, and workloads remain on supported, secure versions; implement drift detection and lifecycle management.
• Establish platform observability: Azure Monitor/Log Analytics/App Insights, CloudWatch, OpenTelemetry where used; improve alert quality and operational readiness.
• Build and maintain backup/DR posture with tested RTO/RPO, runbooks, and regular restore/DR exercises.
• Drive FinOps discipline: cost allocation, tagging compliance, rightsizing, reservations/savings plans, and cost anomaly detection.

Security, Governance & Incident Readiness

• Ensure security controls are in place and effective (least privilege, secure baselines, encryption, key management, vulnerability/patch posture).
• Log & telemetry onboarding: own onboarding of data/log sources and integration with the SIEM (e.g., Microsoft Sentinel/Splunk) in partnership with Security.
• Lead incident response for infrastructure/cloud events: triage, investigation, reporting, RCA, and implementation of preventative controls and guardrails.
• Manage, document, and audit configuration changes; champion "repeatable by design" changes and reduce configuration drift.

Wintel & Core Infrastructure Leadership

• Provide technical leadership across core infrastructure services: Windows Server, AD DS, DNS/DHCP, certificates/PKI, and integration with Entra ID.
• Guide virtualisation/storage teams (VMware/Hyper‑V, SAN/storage) towards cloud‑aligned standards for resilience, security, and lifecycle.

Leadership and Uplift

• Act as the technical authority for infrastructure and hybrid cloud lead technical decisions and drive outcomes.
• Mentor and upskill engineers on modern cloud infrastructure practices; run knowledge sessions and codify standards into reusable patterns.
• Provide input during design and architectural discussions with DevOps and software teams; unblock delivery with clear, pragmatic guidance.

Requirements

Must‑Have Skills & Experience

• Strong enterprise infrastructure background with a Wintel core (Windows Server, AD, DNS/DHCP, certificates) and operational discipline.
• Demonstrable, hands‑on Azure production experience including:
• Identity/RBAC/Entra integration
• VNets, VPN/ExpressRoute, Private Link/Endpoints
• Azure Monitor/Log Analytics, backup/DR patterns, policy/guardrails
• Working knowledge of AWS production environments (accounts/VPC, security groups, IAM basics, CloudWatch).
• Strong troubleshooting and incident leadership across OS/network layers; confident with vendors/escalations.Scripting/automation mindset (strong PowerShell; Bash/Python beneficial).
• Ability to create architecture artefacts: reference designs, diagrams, standards, and decision records (ADRs).

Preferred Certifications

AZ-104 , AZ-305 or AZ-500

Desirable

• Conditional Access and privileged access controls (PIM), break‑glass patterns, Zero Trust principles.
• Azure Policy/AWS Config, Defender for Cloud/Security Hub, GuardDuty; landing zone governance tooling.
• AWS Control Tower, IAM Identity Center, CloudFormation (read/maintain).
• Infrastructure-as-Code familiarity (Terraform/Bicep) preferred, but not essential.
• Exposure to containers/AKS/EKS and CI/CD concepts (as an enabling partner).
• Experience supporting web hosting environments (CDN/WAF, TLS/PKI, caching/performance).