Senior Azure DevSecOps Engineer

About the role

This is a 6-month initial contract position for a Senior Azure DevSecOps Engineer to architect enterprise-scale Azure infrastructure. The role requires expertise in modular Terraform, GitHub Actions/Azure DevOps, API-first architecture, Azure APIM, and zero-trust security. You will build serverless event-driven pipelines, implement immutable storage patterns, and ensure compliance with financial regulations.

Key Responsibilities

• Configure and secure Azure API Management (APIM) using advanced inbound/outbound XML policies, OAuth2/JWT token validation, rate limiting, and schema validation
• Build serverless ingestion pipelines leveraging Azure Functions (durable execution patterns) and Azure Service Bus
• Implement time-based WORM retention locks on Azure Blob Storage, tamper-evident metadata indexing on Azure Cosmos DB, and Redis Cache for high-throughput querying
• Develop modular, reusable Terraform code integrated with CI/CD pipelines (GitHub Actions/Azure DevOps) to maintain 100% automated, zero-click deployment
• Architect private endpoints, VNet integration, NSGs, and automated envelope encryption via Azure Key Vault using customer-managed keys (CMK)
• Write KQL queries to establish audit dashboards, real-time alerting, and automated compliance logging within Azure Log Analytics

Required Qualifications

• 8+ years architecting enterprise-scale Azure infrastructure using modular Terraform with GitHub Actions/Azure DevOps CI/CD pipelines
• 8+ years engineering API-first architectures and advanced Azure API Management (APIM) policies (XML transformations, JWT validation, rate limiting)
• 4+ years designing zero-trust networking architectures with Private Endpoints, VNets, and envelope encryption via Azure Key Vault (CMK, automated rotation)
• 3+ years implementing immutable data patterns and auditing using Azure Blob WORM storage policies and Cosmos DB Change Feed indexing
• 3+ years writing serverless event-driven ingestion pipelines using Python/Node.js, Azure Functions (durable patterns), and Azure Service Bus
• 3+ years building enterprise telemetry and audit analytics using KQL within Azure Log Analytics Workspace and Sentinel/Monitor
• Demonstrated experience hardening cloud-native platforms to meet strict financial regulatory standards (PCI-DSS, SOX, GLBA)
• 8+ years of hands-on experience engineering and securing production workloads in Microsoft Azure
• Proven track record building event-driven and API-first architectures
• Deep technical expertise with Azure API Management (APIM) policy design, backend configuration, and versioning
• Strong proficiency with Terraform (modules, remote state, provider configuration) and CI/CD pipelines
• Practical experience deploying and managing NoSQL databases (Azure Cosmos DB) and immutable storage patterns
• Working development experience in Python and Node.js for serverless integrations
• Working knowledge of zero-trust network design (Private Link, VNets) and Key Vault key rotation/purge protection
• Strong KQL query-writing skills for log analytics and auditing

Preferred Qualifications

• Bachelor's degree in Computer Science, Cyber Security, or equivalent experience
• Active security certifications: Azure Security Engineer Associate (AZ-500), CISSP, CCSP, or AWS Certified Security Specialty