Cloud Engineering Lead (Azure)

6 month contract, scope to extend

-600 - -625 P/D Inside IR35

Hybrid

Active SC would be advantageous

We are looking for a hands-on Cloud Engineering Lead with deep Microsoft Azure expertise to build, run and
productise an enterprise Azure platform. You will turn approved architecture into policy-governed infrastructure
delivered entirely through code and automated pipelines, make sure the platform is reliable and operationally ready,
and treat product teams as customers, giving them a clear, low-friction route onto the platform.

Key responsibilities -

Platform engineering

• Lead design and build of Azure Landing Zones: management groups, subscription vending and hub-and-spoke
• networking.
• Own the provisioning pipelines and a reusable Terraform/Bicep module library built on Azure Verified Modules.
• Enforce governance as code (Azure Policy, RBAC/PIM, Defender for Cloud) and integrate ServiceNow to
• automate platform requests.
• Set engineering quality standards: code reviews, branching and release strategy, pipeline quality gates.
• Lead brownfield remediation of existing subscriptions and workloads onto platform standards.

Reliability and operations

• Define platform SLOs and track service health through observability built on Azure Monitor / Log Analytics,
• integrated with Sentinel (Security Operations) and the NOC.
• Drive operational readiness and acceptance, with runbooks and documentation in place before handover to Cloud
• Run (BAU operations).
• Lead resolution of platform incidents, feed root causes into problem management, and reduce toil through
• automation as part of continual service improvement.

Consumer experience and adoption

• Understand the consumer journey and operate the platform "front door": intake, onboarding and the service
• catalogue.
• Publish paved roads with clear documentation, and run onboarding clinics to drive adoption.
• Use feedback and friction analysis to improve the experience, including the AVD / engineering workspace
• experience.
• Apply the "rule of three": a pattern requested three or more times becomes a productisation candidate for the
• catalogue.

Mandatory skills & experience

• Extensive hands-on Microsoft Azure experience (typically 7+ years in IT, 4+ on Azure) covering design,
• architecture and implementation of enterprise platforms.
• Proven delivery of Azure Landing Zones / Cloud Adoption Framework: management groups, subscription
• vending, hub-and-spoke, Azure Firewall, private DNS and Private Endpoints.
• Expert Terraform and Bicep: modular design, state management, testing and versioning; working knowledge of
• Azure Verified Modules.
• Strong Python (plus PowerShell / Azure CLI) for automation and API integration.
• Proven ability to build and maintain multi-stage, approval-gated provisioning pipelines (Azure DevOps and/or
• GitHub Actions) with Git-based workflows.
• Azure security and governance: Entra ID, RBAC/PIM, managed identities, Key Vault, Azure Policy, Defender for
• Cloud.

Observability and reliability:

• Azure Monitor / Log Analytics, alerting, defining SLOs and service health measures.
• Operational readiness: runbooks, incident handling and handover into run/support teams (ITIL-aligned).
• Experience leading and mentoring cloud/DevOps engineers in an agile team, including code review and release
• practices.

Desirable skills & experience

• Platform-as-a-product experience: paved roads / golden paths, service catalogue, developer experience and
• consumer feedback loops.
• ServiceNow integration for self-service provisioning and ITSM (incident, problem, change).
• Microsoft Sentinel and integration with SOC / NOC functions.
• SRE practices: error budgets, post-incident reviews, toil measurement.
• Brownfield remediation or migration of existing Azure estates.
• Azure Virtual Desktop (AVD) / Windows 365 workspace experience.
• AI and integration platform services: Azure OpenAI / AI Foundry, API Management, Service Bus, Event Grid.
• Policy-as-code testing and pipeline security tooling (e.g. PSRule, Checkov, tfsec).
• FinOps awareness (tagging, budgets, cost reporting); AKS / container platforms.
• Certifications: AZ-305, AZ-400, AZ-104 / AZ-700, HashiCorp Terraform Associate, ITIL 4.