Cloud Architect

EPAM Systems; Turkey; On-site; TRY 5,926,000 - 8,889,000; Full time

Benefits offered by this job

Continuous upskilling

Corporate benefits

USD compensation

Private health insurance

On-site facilities

Job summary

EPAM Systems seeks a Cloud Architect to design and govern our Azure platform architecture, driving automation, security, and scalability across compute, identity, networking, and Kubernetes environments. You will partner with security, network, and platform teams to deliver a robust cloud foundation and self-service capabilities.

Responsibilities include IaC module design, AKS platform governance, and integrating with Backstage templates, Entra ID, and Key Vault for secure operations.

Qualifications

• 5+ years of proven Azure solution/enterprise architecture experience.
• Deep expertise in Terraform/OpenTofu, Azure DevOps, and CI/CD-driven deployment pipelines.
• Experience with Azure identity and access architecture (Entra ID, AD, RBAC) and secrets integration (Key Vault).
• Hands-on experience architecting AKS at production scale, including networking and multi-tenant namespaces.
• English proficiency at B2 level or higher.

Responsibilities

• Architect Infrastructure as Code modules (Terraform/OpenTofu) for Azure services and AVS private cloud modules.
• Define Azure identity architecture and managed identities with secure secret handling.
• Design AKS platform with cluster/node-pool architecture and governance dashboards.
• Collaborate with Network Architect for VNets, ExpressRoute, and connectivity integration.
• Define Image Factory for VM and container baselines and CIS hardening.
• Establish IaC Engine standards (remote state, RBAC, drift detection, policy hooks).
• Coordinate with Backstage and Integration Architects on provisioning templates and observability.

Skills

Azure architecture

Terraform/OpenTofu

Azure DevOps & CI/CD

AKS at scale

Identity & secrets management

Ansible automation

English proficiency (B2+)

Tools

Terraform/OpenTofu

Azure DevOps

Ansible

Log Analytics

Job description

We are seeking a Cloud Architect to design and govern our Azure platform architecture, driving the automation, security, and scalability of infrastructure across compute, identity, networking, and Kubernetes environments. This role partners closely with security, network, and platform engineering teams to deliver a robust, self-service cloud foundation.

Responsibilities

• Architect Infrastructure as Code modules (Terraform/OpenTofu) for Azure App Services, Container Apps, Function Apps, Azure SQL, Azure Cosmos DB, Azure Postgres, and the Azure VMware Solution (AVS) private cloud module, including managed-identity wiring, private endpoints, and diagnostic settings to Log Analytics
• Define the Azure identity architecture in partnership with the security team, including Entra ID, Active Directory, Group Policy Objects, M365 groups, SPN/app registrations, and managed identities, to ensure secrets land in OpenBao/Key Vault per platform standards
• Architect the Azure Kubernetes Service (AKS) platform, including cluster and node-pool design, baseline add-on stack (ingress, cert-manager, external-dns, monitoring, policy), namespace/tenant onboarding, and an operations dashboard for cluster management
• Collaborate with the Network Architect on core connectivity (VNets, Application Gateway, WAF, Azure Firewall, NSGs), DNS, NetBox IPAM, and ExpressRoute connectivity, to ensure Azure compute, database, and AKS modules integrate cleanly with the network foundation
• Define the Image Factory architecture for VM and container golden images (Linux and Windows/cloudbase-init baselines, CIS hardening, agent injection, image scanning, Shared Image Gallery publishing/versioning)
• Establish the foundational Infrastructure as Code Engine standards (remote state/backend, locking, RBAC, module registry, testing framework, drift detection, policy hooks, secrets injection) consumed by all other automation modules
• Collaborate with the Backstage Architect to expose Azure provisioning capabilities as Backstage golden-path templates, and with the Integration Architects on observability, ITSM/CMDB, and security integrations touching Azure resources
• Provide architectural governance during Implementation, validate production deployments, and support module lifecycle ownership during Adoption

Requirements

• 5+ years of proven Azure solution/enterprise architecture experience, ideally validated through Microsoft Azure partner-level engagements or equivalent certification
• Deep expertise in Terraform/OpenTofu, Azure DevOps, and CI/CD-driven deployment pipelines for Azure infrastructure automation, including module design and state management
• Working knowledge of Azure networking constructs (VNets, private endpoints, NSGs) sufficient to integrate compute and data modules with the network foundation owned by the Network Architect
• Hands-on experience architecting Azure Kubernetes Service (AKS) at production scale, including networking, policy, and multi-tenant namespace design
• Experience with Azure identity and access architecture (Entra ID, Active Directory, managed identities, RBAC) and secrets integration (Azure Key Vault, dynamic secrets)
• Experience with Configuration as Code (Ansible) for VM post-provisioning and golden-image pipelines
• English proficiency at B2 level or higher

Nice to have

• Experience with Azure VMware Solution (AVS) private cloud provisioning
• Familiarity with certificate lifecycle management platforms (e.g., Venafi) and their integration with Azure Key Vault
• Experience integrating Azure infrastructure automation with a Backstage-based (or comparable) developer portal
• Knowledge of policy-as-code engines (OPA/Conftest, Azure Policy) for automated compliance enforcement
• Prior experience in large-scale, multi-region Azure landing-zone or platform engineering

We offer

• CONTINUOUS UPSKILLING, LEARNING & DEVELOPMENT
  Diversity of tasks and projects
  Assessment center for objective review of competency level
  Personal development plan
  Mentoring programs and leadership development
  Certification and professional development support
  Access to learning platforms including more than 2,500 internal courses
  English courses taught by certified teachers
• CORPORATE BENEFITS
  Extra leave days
  Referral bonuses
• COMPENSATION PACKAGE
  Competitive compensation paid in USD
  Regular salary and performance reviews
• MEDICAL & HEALTHCARE
  Private health insurance
  Well-being events
• WORKING ENVIRONMENT
  Recreation areas and kitchens
  Tea, coffee and snacks
  Sports equipment and game consoles
  IT Equipment
  Microsoft’s Software Assurance Home Use Program (HUP)

Please note that our Talent Attraction Team reviews applications and CVs submitted in English.

EPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.