Senior Infrastructure Engineer- Secure Developer Platforms (Azure/VDI)

We're looking for a Senior Infrastructure Engineer to build a secure, self-service developer sandbox inside a regulated energy utility's Azure tenant. You'll deliver non-persistent, streamed desktops on Azure Virtual Desktop and Omnissa Horizon that rebuild clean at every log off, keep developers' work, and send all traffic through TLS-inspected egress while still booting in under a minute. You'll own the stack from landing zone to golden image. Key Responsibilities: • Non-Persistent Desktops: Stand up pooled AVD and Omnissa Horizon (instant clone) desktops streamed over HTTPS 443; run the head-to-head POC that selects the platform; persist developer state with FSLogix or Dynamic Environment Manager and App Volumes. • Landing Zone & Inspected Egress: Build hub-and-spoke VNets segmented from production, with forced-tunnel egress through Azure Firewall Premium (TLS inspection, IDPS), private endpoints, and DNS; tune inspection so Git, package managers, GitHub Copilot, and AI/MCP endpoints keep working. • Golden Image & Endpoint Controls: Own the Azure Image Builder or Packer pipeline to Azure Compute Gallery (build, patch, CIS-harden, scan, publish); keep CarbonBlack App Control allow-lists and BeyondTrust EPM working across rebuilds. • Identity, Guardrails & Logging: Enforce guardrails as code with Azure Policy and Terraform or Bicep; wire a non-production identity tenant, per-project RBAC, and Key Vault; forward firewall, desktop, and provisioning logs to Sentinel or Splunk. • Self-Service, AI Agents & Handover: Build ephemeral resource templates with TTL and an orphaned-resource reaper; expose image pipelines so AXIOM AI agents can propose promotions that humans approve; deliver architecture, runbooks, and a support model. Qualifications • Bachelor's degree in a related field (or equivalent practical experience). • 8+ years in infrastructure or platform engineering, including 4+ years of hands-on Azure in an enterprise or regulated environment. • Virtual Desktop: Delivered at least one production AVD or Omnissa / VMware Horizon deployment, including non-persistent pools, image lifecycle, and FSLogix or DEM / App Volumes at scale. • Azure Networking: Deep experience with VNets, UDRs, Azure Firewall (Premium TLS inspection preferred), Private Link, DNS, and NSGs, including troubleshooting broken TLS chains. • IaC & Identity: Expert Terraform or Bicep run through CI/CD; Packer or Azure Image Builder; Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy. • Working knowledge of Windows 11 multi-session hardening and Linux for container workloads; clear writer who can get a design approved by a Cyber Risk reviewer. Nice to Have / Preferred Qualifications: • Certifications: Azure: AZ-104, AZ-700, AZ-140, AZ-305; Terraform Associate; VCP-DTM. • Tuning CarbonBlack App Control, BeyondTrust EPM, CrowdStrike, or Defender for Endpoint for developer workloads. Additional Information We Value: • Drive: Passion and energy to implement quality technical solutions. Self-motivation and intellectual curiosity • Commitment to Quality: Passion to conceive and produce world-class solutions that drive real-world value for the customer • Customer Focus: Consultative approach to solving problems for customers. Expectations management. • Communication: Superior communication skills. Ability to clearly articulate problems, solutions, risks, rewards etc. (written and verbal) • Technical Skills: Love for technology. You have to be inherently passionate about technology. • Business Acumen: Technology ultimately is used to enable the business. We look for people who understand how the businesses can be enabled through their technical solutions