Cloud Architect

Azure Cloud Architect + DevOps Engineer

About the role

Our entire stack runs on Azure Container Apps, App Services, Function Apps, Azure AI Search, Cosmos DB for PostgreSQL, Azure Database for PostgreSQL, Storage, Service Bus, Front Door plus an edge CDN provider (e.g. Cloudflare) for our public domains. We need one person who lives at the intersection of cloud architecture (designing the next major change) and operational DevOps (running the pipelines, the network, the cost, the security every day). You are not a platform-team-of-five behind a ticket queue; you are a builder / operator who owns the cloud end-to-end and partners with engineering to ship faster and cheaper.

What you'll do

Architecture

• Own the Azure architecture diagram across the platform and keep it current.

• Design changes to topology as the product grows (new container apps, replicas / autoscale rules, search-index sharding, queue strategies, multi-region considerations).

• Approve major infrastructure changes from engineering schema migrations on shared DBs, new public endpoints, new secrets in Key Vault, cross-service dependencies.

• Define and enforce naming conventions, resource tagging (cost centre, environment, owner), and resource-group structure across subscriptions.

Networking & edge

• Manage DNS (public domains and internal Azure DNS zones).

• Own Azure Front Door profiles origins, routes, rules, custom domains, SSL / TLS.

• Manage the edge CDN provider (e.g. Cloudflare) for public surfaces DNS, page rules, caching, purge workflows, security rules.

• Azure Application Gateway where still in play.

• WAF policies rule tuning, false-positive triage, blocking abusive traffic without blocking real users.

• Plan and execute domain migrations, certificate renewals, and edge cache strategy.

DevOps & CI/CD

• Own Azure DevOps Pipelines build / test / release templates, service connections, variable groups, environment approvals, artifact retention.

• Container build optimisation (image size, layer cache, build time), ACR retention policies.

• Deployment strategies blue / green via container-app revisions, canary rollouts, rollback playbooks.

• Pipeline templates that every engineering team can reuse without copy-paste.

• Secret management Key Vault references, rotating credentials, getting secrets out of .env files.

FinOps / cost optimisation

• Continuously audit Azure spend across all subscriptions and bring monthly cost reports to leadership.

• Identify and execute cost-cutting moves right-sizing container apps, reserving compute where stable, switching tiers, killing zombie resources, reviewing egress / CDN charges.

• Quantify cost-versus-performance trade-offs for any proposed architecture change.

Must-have experience

• 6+ years in Azure as primary cloud (not someone who learned it last year).

• Azure services mastery: Container Apps, App Services, Function Apps, ACR, AKS basics, Azure Database for PostgreSQL, Cosmos DB for PostgreSQL (Citus), Storage Blob, Service Bus, Key Vault, Application Insights, Log Analytics.

• Azure Front Door (Standard + Premium) deep configuration experience.

• Edge CDN provider (e.g. Cloudflare) at the operational level zone management, page rules, firewall rules, cache purge, API automation.

• WAF rule design and tuning (Azure FD WAF or equivalent).

• DNS at scale public, private, split-horizon, NS delegation.

• Azure DevOps Pipelines YAML templates, multi-stage pipelines, service connections (and the permission politics of who can create them).

• Networking fundamentals VNet, NSG, peering, private endpoints, service endpoints.

• Strong scripting: Bash, PowerShell, Python; comfortable with the Azure CLI.

• IaC: Bicep or Terraform (at least one in production), and ARM as a fallback when reading legacy.

• FinOps practice has actually saved money in a prior role, not just read about it.

Nice to have

• Azure certifications (AZ-104 / AZ-305 / AZ-400).

• Multi-subscription tenant management with Entra ID (formerly Azure AD).

• Kubernetes (AKS) even if not currently in use.

• SRE practices SLOs, error budgets, on-call rotations.

• Observability beyond App Insights Grafana, Datadog, ELK stacks.

• Database operations background (PostgreSQL HA, replication, point-in-time restore).

• Security background (CIS benchmarks, vulnerability scanning, container scanning).