Senior Azure Infra Engineer – Secure Self-Service Desktops

Oteemo Inc.

Hampton (VA)

On-site

USD 140,000 - 190,000

Full time

2 days ago

Be an early applicant

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Oteemo is seeking a Senior Infrastructure Engineer to build a secure, self-service developer sandbox inside a regulated energy utility's Azure tenant. You will deliver non-persistent desktops on Azure Virtual Desktop and Omnissa Horizon, ensuring fast boot, TLS-inspected egress, and automated rebuilds.

You will own the stack from landing zone to golden image and enforce guardrails with Azure Policy in a CI/CD workflow.

Qualifications

8+ years in infrastructure or platform engineering, including 4+ years hands-on Azure in an enterprise or regulated environment.
Virtual Desktop: Delivered at least one production AVD or Omnissa / VMware Horizon deployment, including non-persistent pools, image lifecycle, and FSLogix or DEM / App Volumes at scale.
Azure Networking: Deep experience with VNets, UDRs, Azure Firewall (Premium TLS inspection preferred), Private Link, DNS, and NSGs, including troubleshooting broken TLS chains.
IaC & Identity: Expert Terraform or Bicep run through CI/CD; Packer or Azure Image Builder; Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy.

Responsibilities

Non-Persistent Desktops: Stand up pooled AVD and Omnissa Horizon desktops streamed over HTTPS 443; persist developer state with FSLogix or Dynamic Environment Manager and App Volumes.
Landing Zone & Inspected Egress: Build hub-and-spoke VNets segmented from production, with forced-tunnel egress through Azure Firewall Premium TLS inspection and DNS; ensure Git, package managers, GitHub Copilot, and AI endpoints keep working.
Golden Image & Endpoint Controls: Own the Image Builder / Packer pipeline to Azure Compute Gallery; CIS hardening, patching, and publish; manage allow-lists for CarbonBlack App Control and BeyondTrust EPM across rebuilds.
Identity, Guardrails & Logging: Enforce guardrails as code with Azure Policy and Terraform or Bicep; provision a non-production identity tenant, per-project RBAC, and Key Vault; forward logs to Sentinel or Splunk.
Self-Service, AI Agents & Handover: Build ephemeral resource templates with TTL; expose image pipelines for AXIOM AI agent promotions; deliver architecture, runbooks, and a support model.