Cloud Infrastructure Engineer
About The Position
The Cloud Infrastructure Engineer is responsible for designing, deploying, managing, and optimizing BS&A Software’s hybrid infrastructure across Microsoft Azure and Azure Local (formerly Azure Stack HCI) to ensure high availability, security, resiliency, and operational efficiency. This role is focused on infrastructure engineering across cloud and on-premises environments, including compute, storage, identity, backup and disaster recovery, network connectivity, and related platform services.
Position Qualifications
Education: Bachelor’s degree in Computer Science, Information Technology, Engineering, or a related field preferred
Microsoft Azure certifications such as Azure Administrator, Azure Solutions Architect, or other relevant cloud, networking, or security certifications are preferred
Equivalent combinations of education, training, and relevant experience may be considered in lieu of a degree
Experience: Minimum of 4 years of experience in cloud engineering, infrastructure engineering, systems administration, or network engineering, with a strong focus on Microsoft Azure and hybrid infrastructure
Hands-on experience designing, deploying, and supporting Azure infrastructure, including Virtual Machines, Storage, Virtual Networks, backup and disaster recovery, monitoring, and identity services
Supporting hybrid environments that integrate on-premises infrastructure with Azure, including Azure Local (formerly Azure Stack HCI), Windows Server, Hyper-V, hyperconverged infrastructure, or comparable virtualization platforms
Implementing and managing Microsoft’s Cloud Adoption Framework (CAF), including management groups, subscription structure, Azure Policy, and governance guardrails
Strong experience with enterprise networking, including routing, switching, VLANs, VPNs, DNS, load balancing, segmentation, and firewall policy management
Hands-on experience administering and troubleshooting Palo Alto firewalls and Cisco network infrastructure
Experience designing and supporting Azure networking components, including Virtual Networks, VPN Gateways, ExpressRoute, Network Security Groups, Azure Firewall, and hybrid connectivity
Implementing and supporting identity and access controls using Microsoft Entra ID, Conditional Access, RBAC, Privileged Identity Management, and hybrid identity integration
Supporting Azure Virtual Desktop (AVD), including host pools, session hosts, scaling, profile management, and security baselines, preferred
Working knowledge of Microsoft Intune and Windows Autopilot in enterprise environments, including endpoint compliance architecture, provisioning guardrails, and Conditional Access integration
Proficiency in scripting and automation using PowerShell and Azure CLI; Python experience is a plus
Familiarity with Azure cost management, performance monitoring, and capacity planning, including tools and practices used to optimize cloud spend and operational efficiency
Experience supporting core hybrid infrastructure services, including Active Directory, DNS, DHCP, and file services, preferred
Experience working with third-party infrastructure or network partners, including reviewing designs, validating configurations, and receiving technical handoffs
Experience supporting infrastructure for multi-tenant hosted or SaaS environments, including tenant isolation, high availability, segmentation, and security controls for customer-facing workloads, preferred
Essential Job Tasks
Design, deploy, administer, and support Azure and Azure Local infrastructure across production and non-production environments
Own and maintain Azure governance standards aligned with Microsoft’s Cloud Adoption Framework (CAF), including management groups, subscription organization, policy assignments, and tagging standards
Configure, manage, and troubleshoot Azure networking and hybrid connectivity, including Virtual Networks, VPN Gateways, ExpressRoute, DNS, segmentation, and firewall controls
Administer and support Palo Alto firewalls and Cisco network infrastructure, including policy management, routing, switching, connectivity troubleshooting, and security hardening
Support Azure Local and related on-premises infrastructure, including hosts, storage, clustering, virtualization, and connectivity components
Implement and maintain identity and access controls using Microsoft Entra ID, Conditional Access, RBAC, and Privileged Identity Management
Engineer, maintain, and optimize Azure Virtual Desktop (AVD) infrastructure, including session hosts, scaling plans, profile management, and security baselines
Monitor infrastructure health, performance, availability, and cost using Azure Monitor, Log Analytics, Azure Cost Management, and related operational tools; proactively identify and resolve issues
Implement and maintain backup, disaster recovery, and business continuity capabilities across cloud and hybrid environments
Apply security best practices across cloud and network infrastructure, including encryption, segmentation, secure administration, logging, and privileged access controls
Use scripting and automation to improve operational efficiency, standardize configurations, and reduce manual administrative effort
Serve as the internal technical counterpart for infrastructure and network implementation partners, validating designs, reviewing deliverables, and ensuring long-term maintainability of the environment
Collaborate with End User Support to define and maintain architectural guardrails for Microsoft Intune, Windows Autopilot, Conditional Access integration, and endpoint compliance standards
Maintain technical documentation, architecture diagrams, runbooks, standards, and support procedures
Participate in incident response, problem management, root cause analysis, maintenance activities, and on-call rotation as required
Collaborate with security, IT operations, and other technical teams to align infrastructure with organizational standards, operational requirements, and compliance expectations
Provide Tier 3 escalation support for complex infrastructure, networking, and identity issues that extend beyond day-to-day support operations