Azure network and security architect (Cloud Area)

Aqilea; United States; Remote; USD 26,000 - 37,000; Full time

Job summary

Aqilea seeks a Senior Azure Cloud Architect to design, secure and operate production-grade Azure environments. You will lead Landing Zone design, enterprise networking, and security governance using Terraform/Bicep and IaC with Azure DevOps or GitHub Actions. You will mentor engineers, collaborate with stakeholders, and ensure compliance with frameworks.

Remote work is available for this assignment. Responsibilities include building scalable networks, implementing identity governance, and

Qualifications

• 10+ years of hands-on Azure architecture experience.
• Expert in Azure Landing Zones and enterprise networking.
• Proficient with Terraform or Bicep and Git-based CI/CD.
• Deep knowledge of TCP/IP, DNS, routing, and security controls.
• Experience with multi-subscription, governance and cost controls.

Responsibilities

• Design and implement enterprise-grade Azure Landing Zones.
• Develop and enforce IAM, RBAC, and governance policies.
• Architect secure networking with Hub-and-Spoke, ExpressRoute, and VPNs.
• Automate infrastructure with IaC and CI/CD pipelines.
• Lead stakeholders and mentor engineers.

Skills

Azure Networking

Azure Security

Terraform / Bicep

CI/CD for Infra

Multi-subscription Environments

Tools

Terraform

Bicep

Git workflows

Azure DevOps

Job description

Location: India

Role: Azure network and security architect (Cloud Area)
Job Ref Id: JD-1346
Competence level: 10 + Years
Start date: 2026-11-15
End date: 2027-05-31
Extension option: Yes
Scope: Yes
Location: India
Remote work: Yes
Language: English
Application deadline: 2026-11-30
Number of consultants: 1
Security clearance: No

About the assignment

We are looking for a highly skilled Senior Azure Cloud Architect with deep expertise in Azure Networking, Azure Security, and Enterprise-scale Landing Zone architecture. You will design, build, secure and operate production-grade Azure environments aligned with the Microsoft Cloud Adoption Framework and Well-Architected Framework, using Infrastructure-as-Code, automation, governance and identity/security controls. The role includes acting as a technical advisor, leading cloud transformation initiatives and mentoring engineering teams, requiring strong communication and stakeholder management.

Responsibilities

• Design and implement enterprise-grade Azure Landing Zones aligned with Microsoft Cloud Adoption Framework, Azure Enterprise-Scale Architecture and Zero Trust Security Model.

• Define and implement management groups hierarchy, subscription strategy and lifecycle management, resource organization standards, naming conventions and tagging strategy, RBAC and identity governance, and policy-driven governance and compliance.

• Establish multi-subscription, multi-environment (Prod/Non-Prod/Sandbox) architecture.

• Azure Networking:

• Architect secure and scalable network topologies including Hub-and-Spoke, Virtual WAN, ExpressRoute and Site-to-Site VPN connectivity.

• Design private connectivity patterns such as Private Endpoints and Private DNS Zones and implement Azure Firewall, NSGs, ASGs, route tables, load balancers, Application Gateway and Front Door.

• Design IP addressing strategy and network segmentation, implement network security controls and traffic inspection models, and optimize network performance, availability and resiliency.

• Azure Security & Governance:

• Implement enterprise security posture using Microsoft Defender for Cloud, Azure Policy and Initiative assignments, Azure Blueprints (where applicable), Conditional Access, Identity Protection and Privileged Identity Management.

• Design secure identity architecture using Entra ID (Azure AD), RBAC models, least-privilege access and Managed Identities.

• Ensure compliance with regulatory standards (ISO, SOC2, CIS, NIST as applicable) and establish logging, monitoring, SIEM integration and audit controls.

• Infrastructure as Code & Automation:

• Develop reusable, modular Infrastructure-as-Code using Terraform (preferred) and/or Bicep.

• Create standardized deployment pipelines using Azure DevOps or GitHub Actions and implement CI/CD practices for infrastructure delivery.

• Enforce version control, peer reviews, testing and promotion pipelines and automate provisioning, governance, security baselines and guardrails.

• Operations, Reliability & Cost Management:

• Design for high availability and disaster recovery, backup and recovery, scalability and performance optimization.

• Implement observability using Azure Monitor, Log Analytics and Application Insights and enable cost governance using Cost Management, budgeting and rightsizing.

• Stakeholder Engagement & Leadership:

• Translate business requirements into technical architecture and produce high-quality architecture documentation, diagrams and runbooks.

• Lead technical discussions with customers, auditors, security teams and delivery teams, mentor junior engineers, and participate in design reviews, audits and governance forums.

Requirements

Mandatory

• Experience: 10+ Years
• Strong hands-on expertise with: Microsoft Azure platform (IaaS, PaaS, Networking, Security); Azure Landing Zone design and deployment; Enterprise networking architectures; Identity and access management; Azure security tooling and governance
• Expert-level proficiency in: Terraform and/or Bicep; Git-based workflows; CI/CD pipelines for infrastructure
• Deep knowledge of: TCP/IP, DNS, routing, firewall concepts; Hybrid connectivity models; Cloud security best practices; Infrastructure automation patterns
• Experience working in multi-subscription, enterprise environments.