Azure Cloud Engineer (L3)

Azure landing zones and governance
Design and deploy Azure landing zones aligned to the Cloud Adoption Framework (CAF) and Azure Landing Zone (ALZ) reference architecture.
Build management group hierarchies, platform subscriptions (identity, management, connectivity) and subscription vending for application landing zones.
Implement policy-driven governance with Azure Policy initiatives (deny, audit, modify, deployIfNotExists), managed as code.
Define and enforce naming, tagging, RBAC and resource organisation standards across customer tenants.
Customise the ALZ Bicep or Terraform accelerators and Azure Verified Modules to each customer’s requirements.
Map controls to UAE requirements where they apply: UAE IA Regulation, DESC ISR, ADHICS, UAE PDPL and in-country data residency (UAE North, UAE Central).
Run Well-Architected reviews and landing zone health checks on existing estates, then lead the remediation.
Azure Virtual Desktop (AVD)
Design and deploy AVD end to end: pooled and personal host pools, application groups, workspaces, RemoteApp and full desktops.
Build golden images with Azure Compute Gallery and Azure VM Image Builder, and run the monthly image update cycle.
Implement FSLogix profile containers on Azure Files or Azure NetApp Files, sized for IOPS, capacity and availability.
Configure scaling plans, Start VM on Connect and VM sizing to balance user experience against cost.
Deliver applications through App Attach and Windows multi-session images with Microsoft 365 Apps and optimised Teams.
Secure AVD with Conditional Access, MFA, Entra join or hybrid join, Intune, RDP property controls, screen capture protection and watermarking.
Resolve L3 issues such as connection failures, agent faults, FSLogix profile locks, black screens and slow logons, using AVD Insights and KQL.
Lead migrations to AVD from Citrix, Omnissa Horizon (formerly VMware Horizon) or Remote Desktop Services.
Azure networking
Design hub-and-spoke and Virtual WAN topologies, including IP address planning, segmentation and routing.
Implement hybrid connectivity with ExpressRoute (redundant circuits, private peering, Global Reach) and site-to-site or point-to-site VPN with BGP.
Deploy and operate Azure Firewall Premium and Firewall Manager, or third-party NVAs such as Palo Alto and Fortinet in highly available designs.
Engineer routing with route tables, Azure Route Server and forced tunnelling, and resolve asymmetric routing.
Design hybrid DNS for private endpoints using Private DNS zones and Azure DNS Private Resolver.
Publish applications securely through Application Gateway WAF v2, Azure Front Door, Load Balancer and Private Link.
Troubleshoot with Network Watcher, VNet flow logs, Traffic Analytics, connection troubleshoot and packet capture.
Security and identity
Configure Microsoft Entra ID: hybrid identity (Entra Connect or Cloud Sync), Conditional Access, MFA, Privileged Identity Management and Identity Protection.
Apply least-privilege Azure RBAC and custom roles, using managed identities and workload identity federation instead of stored secrets.
Deploy and tune Microsoft Defender for Cloud (CSPM and workload protection plans), and raise secure score and compliance ratings.
Onboard Microsoft Sentinel data connectors, and tune analytics rules and automation playbooks with the SOC team.
Enforce Zero Trust controls: private endpoints, disabled public access, Azure Bastion, just-in-time VM access and DDoS Protection.
Manage keys, secrets and certificates in Azure Key Vault or Managed HSM, including customer-managed key encryption.
Remediate findings from vulnerability scans, penetration tests and compliance audits.
DevOps, infrastructure as code and automation
Build reusable Terraform and Bicep modules for landing zones, networking, AVD and workloads, version-controlled in Git.
Design CI/CD pipelines in Azure DevOps or GitHub Actions with plan and what-if stages, approvals, environments and drift detection.
Secure pipelines with workload identity federation, Key Vault-referenced secrets, branch policies and peer review.
Add IaC and policy checks to pipelines, such as PSRule for Azure, Checkov and TFLint.
Automate operations with PowerShell, Azure CLI, Python, Azure Automation, Azure Functions and Logic Apps.
Deploy and support AKS clusters at platform level: networking, identity, ingress, upgrades and container registry.
Professional services delivery and migrations
Lead technical delivery from discovery to handover: workshops, assessments, HLD/LLD, build, testing, go-live and hypercare.
Run migrations with Azure Migrate: discovery, dependency analysis, wave planning, replication, test failover, cutover and rollback.
Estimate effort and define technical scope for statements of work, and raise delivery risks early with the project manager.
Lead design sessions with customer stakeholders and obtain design sign-off before build.
Implement changes through the customer’s change process, with tested implementation and rollback plans.
Hand over as-built documentation, runbooks and knowledge transfer so managed services can operate the estate from day one.
L3 operations and managed services
Act as the final internal escalation point for P1/P2 incidents across compute, networking, identity, AVD and security.
Lead major incident bridges: restore service, coordinate teams and give customers clear, timely updates.
Own problem management: deliver root cause analyses (RCAs) with permanent fixes and preventive actions.
Raise and drive Microsoft support cases through Unified Support or CSP partner channels.
Implement high-risk changes, and review L2 changes as technical approver at the change advisory board (CAB).
Manage delegated multi-tenant access through Azure Lighthouse and Partner Center GDAP on least privilege.
Design monitoring with Azure Monitor, Log Analytics (KQL), Azure Monitor Agent, data collection rules, workbooks and action groups.
Run backup and DR with Azure Backup and Azure Site Recovery, including restore tests and DR drills against agreed RPO/RTO.
Manage patching and hybrid servers with Azure Update Manager and Azure Arc.
Drive FinOps: rightsizing, reservations, savings plans, Azure Hybrid Benefit, budgets and cost anomaly alerts.
Present monthly service reviews covering incidents, SLA performance, security posture, cost and improvement actions.

Work arrangement
Yes