Senior Infra Engineer - Secure Dev Platforms (Azure/VDI)

Oteemo Inc.; Virginia; On-site; USD 140,000 - 190,000; Full time

Job summary

Oteemo Inc. is seeking a Senior Infrastructure Engineer to design and operate a secure, self-service developer desktop environment inside a regulated energy utility's Azure tenant.

You will deliver non-persistent desktops on Azure Virtual Desktop and Omnissa Horizon, build landing zones, and ensure TLS-inspected egress while keeping performance under one minute boot. You will own the stack from landing zone to golden image, enforce guardrails with Azure Policy and IaC, and collaborate with

Qualifications

• Bachelor's degree in related field or equivalent practical experience.
• 8+ years in infrastructure or platform engineering, including 4+ years of hands-on Azure in an enterprise or regulated environment.
• Virtual Desktop: Delivered at least one production AVD or Omnissa / VMware Horizon deployment, including non-persistent pools, image lifecycle, and FSLogix or DEM / App Volumes at scale.
• Azure Networking: Deep experience with VNets, UDRs, Azure Firewall (Premium TLS inspection preferred), Private Link, DNS, and NSGs, including troubleshooting broken TLS chains.
• IaC & Identity: Expert Terraform or Bicep run through CI/CD; Packer or Azure Image Builder; Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy.
• Working knowledge of Windows 11 multi-session hardening and Linux for container workloads; clear writer who can get a design approved by a Cyber Risk reviewer.

Responsibilities

• Non-Persistent Desktops: Stand up pooled AVD and Omnissa Horizon desktops streamed over HTTPS; persist developer state with FSLogix or DEM and App Volumes.
• Landing Zone & Inspected Egress: Build hub-and-spoke VNets segmented from production, with forced-tunnel egress through Azure Firewall Premium (TLS inspection, IDPS), private endpoints, and DNS.
• Golden Image & Endpoint Controls: Own the Azure Image Builder or Packer pipeline to Azure Compute Gallery (build, patch, CIS-harden, scan, publish); keep CarbonBlack App Control allow-lists and BeyondTrust EPM working across rebuilds.
• Identity, Guardrails & Logging: Enforce guardrails as code with Azure Policy and Terraform or Bicep; wire a non-production identity tenant, per-project RBAC, and Key Vault; forward firewall, desktop, and provisioning logs to Sentinel or Splunk.
• Self-Service, AI Agents & Handover: Build ephemer resource templates with TTL and an orphaned-resource reaper; expose image pipelines so AXIOM AI agents can propose promotions that humans approve; deliver architecture, runbooks, and a support model.

Skills

Azure

Terraform

Packer

FSLogix

App Volumes

Azure Networking

Azure Policy

Windows 11 multi-session

Linux containers

Image Builder

Education

Bachelor's degree in related field

Tools

Azure Image Builder

VMware Horizon

CI/CD (Terraform/PIpec)

Entra ID / Key Vault

Job description

Oteemo Inc. is seeking a Senior Infrastructure Engineer to design and operate a secure, self-service developer desktop environment inside a regulated energy utility's Azure tenant.

You will deliver non-persistent desktops on Azure Virtual Desktop and Omnissa Horizon, build landing zones, and ensure TLS-inspected egress while keeping performance under one minute boot. You will own the stack from landing zone to golden image, enforce guardrails with Azure Policy and IaC, and collaborate with