Cloude DevOPS

PathPresenter; Delaware; Hybrid; USD 85,000 - 95,000; Full time

Job summary

PathPresenter is seeking a Senior Azure Cloud & Security Engineer to own the Azure platform end to end, including Terraform-managed AKS, Entra ID, Intune device management, and security monitoring with Microsoft Defender and Sentinel.

You will transform a live UAT AKS setup into a modular dev/stage/prod environment, harden it, and run day-to-day operations in collaboration with application and DevOps teams.

Qualifications

• 5+ years in cloud infra or DevOps.
• 3+ years focused on Microsoft Azure.
• Hands-on production experience with AKS and Kubernetes: networking, node pools, upgrades, RBAC, workload identity.
• Entra ID administration: CA, MFA, PIM, app registrations, RBAC and managed identities.
• Microsoft Intune: device enrollment, compliance and configuration policies, app deployment.
• Microsoft Sentinel and Defender: building analytics rules, triaging incidents, writing KQL.
• CI/CD with GitHub Actions or Azure DevOps, including OIDC federation to Azure.
• Scripting in PowerShell and Bash; Python is a plus.
• Clear written communication: you document what you build.

Responsibilities

• Own the AKS repo and refactor it into reusable modules for dev, UAT, stage and prod.
• Build, upgrade and operate private AKS clusters (Azure CNI, node pools, autoscaling, KEDA, workload identity).
• Run Azure networking: VNets, peering, VPN and NAT Gateway, private endpoints, private DNS, App Gateway for Containers with WAF.
• Operate ACR, Key Vault, Storage, PostgreSQL Flexible Server and Azure Managed Redis, including backup and DR.
• Run Terraform CI/CD in GitHub Actions with OIDC, and support ArgoCD and self-hosted runners.
• Administer Entra ID: users, groups, SSO, Conditional Access, MFA, PIM, RBAC and managed identities.
• Manage devices with Intune and Autopilot: enrollment, compliance, configuration profiles, apps and patching.
• Run Microsoft Sentinel and Defender: analytics rules, KQL hunting, playbooks, incident response, Secure Score.
• Keep secrets safe: rotate keys, move them to Key Vault, remove them from code; own cost, tagging and Azure Policy.
• Support observability (Grafana, Loki, Azure Monitor), HIPAA/SOC 2 compliance, and write runbooks and docs.

Skills

Azure

AKS

Kubernetes

Entra ID

Intune

Microsoft Defender

Microsoft Sentinel

GitHub Actions

OIDC

PowerShell

Python

Documentation

Tools

Terraform

ArgoCD

ARC runners

Azure DevOps

Job description

Job Description: Senior Azure Cloud & Security Engineer

Pathpresenter is hiring a Senior Azure Cloud & Security Engineer to own our Azure platform end to end: Terraform-managed AKS environments, identity in Entra ID, device management in Intune, and security monitoring in Microsoft Sentinel and Defender.

You will take our private AKS platform from one live UAT environment to a clean, modular dev / stage / prod setup, harden it, and run it day to day. The role reports to engineering leadership and works closely with our application and DevOps teams.

• Type: Full-time
• Location: hybrid
• Compensation: 85000 -95000

Key responsibilities

• Own the AKS repo and refactor it into reusable modules for dev, UAT, stage and prod.
• Build, upgrade and operate private AKS clusters (Azure CNI, node pools, autoscaling, KEDA, workload identity).
• Run Azure networking: VNets, peering, VPN and NAT Gateway, private endpoints, private DNS, App Gateway for Containers with WAF.
• Operate ACR, Key Vault, Storage, PostgreSQL Flexible Server and Azure Managed Redis, including backup and DR.
• Run Terraform CI/CD in GitHub Actions with OIDC, and support ArgoCD and self-hosted runners.
• Administer Entra ID: users, groups, SSO, Conditional Access, MFA, PIM, RBAC and managed identities.
• Manage devices with Intune and Autopilot: enrollment, compliance, configuration profiles, apps and patching.
• Run Microsoft Sentinel and Defender: analytics rules, KQL hunting, playbooks, incident response, Secure Score.
• Keep secrets safe: rotate keys, move them to Key Vault, remove them from code; own cost, tagging and Azure Policy.
• Support observability (Grafana, Loki, Azure Monitor), HIPAA/SOC 2 compliance, and write runbooks and docs.

Required qualifications

• 5+ years in cloud infrastructure or DevOps, with 3+ years focused on Microsoft Azure.
• Hands-on production experience with AKS and Kubernetes: networking, node pools, upgrades, RBAC, workload identity.
• Entra ID administration: Conditional Access, MFA, PIM, app registrations, RBAC and managed identities.
• Microsoft Intune: device enrollment, compliance and configuration policies, app deployment.
• Microsoft Sentinel and Defender: building analytics rules, triaging incidents, writing KQL.
• CI/CD with GitHub Actions or Azure DevOps, including OIDC federation to Azure.
• Scripting in PowerShell and Bash; Python is a plus.
• Clear written communication: you document what you build.

Preferred qualifications

• Experience in healthcare or other regulated industries (HIPAA, SOC 2, HITRUST).
• GitOps with ArgoCD and Helm; self-hosted GitHub runners (ARC).
• Grafana, Mimir, Loki or Prometheus-based observability.
• Azure Policy, management groups and landing zones (CAF).
• Azure Database for PostgreSQL, Azure Managed Redis, App Gateway for Containers.
• Checkov, tflint or other IaC security scanning.

Certifications (nice to have)

• AZ-500 Azure Security Engineer
• SC-200 Security Operations Analyst (Sentinel)
• SC-300 Identity and Access Administrator (Entra ID)
• MD-102 Endpoint Administrator (Intune)
• HashiCorp Terraform Associate

Tools and tech stack

Area

What we use

Infrastructure as Code

Compute

Networking

VNets, peering, VPN Gateway, NAT Gateway, App Gateway for Containers + WAF, Private DNS

Data

Secrets

Identity

Microsoft Entra ID, managed identities, workload identity federation

Security

CI/CD

GitHub Actions (OIDC), ArgoCD, ARC runners; Azure DevOps (legacy)

Observability

What success looks like

First 30 days

• Learn the UAT environment, the Terraform repo and the CI pipelines.
• Rotate any hardcoded secrets (such as the VPN pre-shared key) and move them to Key Vault.
• Consolidate onto one CI system for Terraform applies.
• Baseline Entra ID, Intune and Sentinel: what's configured, what's missing.

By 60 days

• Dev and stage environments live from a shared Terraform module, with CI.
• Prod identities, state and DNS separated from non-prod.
• Conditional Access and Intune compliance policies enforced for all staff devices.
• Core Sentinel analytics rules and an incident runbook in place.

By 90 days

• Production AKS environment built and documented.
• Secure Score and Defender recommendations trending up, with a tracked backlog.
• Runbooks and README written so another engineer can operate the platform.