We are seeking a Senior Azure Infrastructure Consultant to design, automate, and operate enterprise-grade Azure infrastructure using modular Terraform within an established Azure landing zone. In this role, you will hold end-to-end technical ownership over infrastructure delivery at the subscription scope-covering identity, virtual networking, Azure Container Apps, managed data services, and workload resilience.
You will work closely with platform leads, security officers, and application teams to translate architectural patterns into reliable, production-hardened infrastructure while embedding automated governance, least-privilege access, and proactive lifecycle operations.
location: Charlotte, North Carolina
job type: Contract
salary: $65 - 76 per hour
work hours: 8am to 5pm
education: Bachelors
responsibilities:
Key Responsibilities
Infrastructure as Code (IaC) & Subscription Governance
- Architect, test, and maintain reusable, version-controlled Terraform modules featuring secure defaults, well-defined inputs/outputs, and clean separation of concerns.
- Structure remote state files across environments and subscriptions to minimize blast radius; manage state imports, resource refactors, and disaster recovery scenarios without production impact.
- Conduct meticulous code reviews and Terraform plan risk assessments to identify forced replacements, unexpected resource recreation, and dependency pitfalls prior to deployment.
- Organize subscriptions, resource groups, and resource lifecycles aligned to workload ownership and access boundaries.
- Ensure compliance within existing Azure Policy guardrails; troubleshoot policy denials, implement programmatic remediation, and prepare justified exemption requests when required.
- Automate diagnostics and log streaming configurations using Terraform to ensure full integration with central logging solutions.
- Standardize resource naming conventions and metadata tagging via code-driven enforcement.
- Evaluate regional deployments based on service and SKU availability, availability zones (AZs), cross-region disaster recovery pairings, latency constraints, and data residency mandates.
- Design and implement Virtual Network (VNet) topologies, CIDR allocation, and subnet sizing for Azure Container Apps, delegated services, and Azure Private Endpoints with capacity for scale.
- Author and optimize Network Security Groups (NSGs) using granular, least-privilege security rules; diagnose complex traffic filtering behavior using effective security rule evaluations.
- Build and manage private endpoints across subscriptions alongside private DNS zones, resolving complex end-to-end DNS resolution issues across hybrid or peered networks.
- Design least-privilege Role-Based Access Control (RBAC) across subscription, resource group, and resource scopes using Microsoft Entra ID groups and custom/built-in roles.
- Implement credential-less, identity-driven authentication between services using Azure User-Assigned Managed Identities and Workload Identity Federation.
- Configure and administer just-in-time (JIT) privileged administrative workflows utilizing Microsoft Entra Privileged Identity Management (PIM).
- Provision and manage Azure Container Apps (ACA) environments featuring private ingress, custom domain configurations, managed identity integration, and secure Azure Container Registry (ACR) bindings.
- Deploy, secure, and operate enterprise data and caching tiers-including Azure Database for PostgreSQL Flexible Server, Azure Cache for Redis, Cosmos DB, and Azure Storage-strictly over private endpoints.
- Architect multi-zone and multi-region high availability (HA) and disaster recovery (DR) solutions aligned to workload Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
- Monitor regional compute constraints, core quotas, and VM family allocation limits; manage quota expansion requests and engineer fallback patterns (e.g., alternative SKUs, capacity reservations).
- Right-size workloads based on operational telemetry to balance compute performance, resilience, and operational expenditure.
- Plan and execute planned maintenance events, major platform upgrades (such as PostgreSQL major version transitions), and API deprecation migrations with minimal service downtime.
- Continuously monitor for and remediate configuration drift between deployed infrastructure and Terraform state.
- Maintain operational readiness through scheduled backup verification, automated restore drills, and simulated failover/DR exercises.
- Troubleshoot complex, escalated infrastructure issues spanning Terraform code, DNS resolution, virtual routing, and IAM permissions to find and remediate root causes.
- Implement post-incident technical safeguards, updated module templates, policy definitions, and clear operational runbooks.
- Track Azure Service Health notifications, optimize resource costs using Azure Advisor/FinOps data, and cleanly decommission stale workloads (retiring orphaned role assignments, DNS records, and network interfaces).
qualifications:
Required Qualifications
5+ years of hands-on experience designing, provisioning, and operating enterprise production infrastructure on Microsoft Azure.
Expert-level Terraform proficiency, demonstrated by building composable modules, managing multi-tier remote states, executing zero-downtime refactors, and writing automated infrastructure tests.
Deep Azure Networking & Security experience, including VNets, subnets, NSGs, private endpoints, Private DNS Zones, and Azure Policy compliance.
Production experience with Modern Compute & Data Platforms, specifically Azure Container Apps (ACA) and managed PaaS offerings (PostgreSQL Flexible Server, Redis, Cosmos DB).
Strong identity fundamentals, including advanced Entra ID RBAC design, Managed Identities, and Workload Identity Federation.
Strong verbal and written communication skills, with a track record of producing clear technical design documents, architectural diagrams, and operational runbooks.
Preferred Qualifications
Active Azure Certifications such as Azure Solutions Architect Expert (AZ-305), Azure Security Engineer Associate (AZ-500), or Azure Administrator Associate (AZ-104).
Hands-on experience querying telemetry and creating dashboards/alerts in Azure Monitor, Log Analytics (using Kusto Query Language / KQL), Prometheus, or Grafana.
Practical knowledge of FinOps methodologies and Azure Cost Management practices (identifying cost anomalies, managing reservations, and right-sizing).
Experience architecting infrastructure within heavily regulated environments (such as financial services, healthcare, or government frameworks like SOC 2, ISO 27001, or HIPAA).
skills:
architectural patterns,Container Apps,data services,Azure Infrastructure,Azure,Terraform,resilience,proactive,automate,automated,governance,infrastructure delivery,infrastructure,least-privilege access,security
Equal Opportunity Employer: Race, Color, Religion, Sex, Sexual Orientation, Gender Identity, National Origin, Age, Genetic Information, Disability, Protected Veteran Status, or any other legally protected group status.
At Randstad Digital, we welcome people of all abilities and want to ensure that our hiring and interview process meets the needs of all applicants. If you require a reasonable accommodation to make your application or interview experience a great one, please contact HRsupport@randstadusa.com.
Pay offered to a successful candidate will be based on several factors including the candidate's education, work experience, work location, specific job duties, certifications, etc. In addition, Randstad Digital offers a comprehensive benefits package, including: medical, prescription, dental, vision, AD&D, and life insurance offerings, short-term disability, and a 401K plan (all benefits are based on eligibility).
This posting is open for thirty (30) days.
