Senior Infrastructure Engineer – Secure Developer Platforms, Azure, VDI

This is a fully remote position, open to applicants in Virginia.

📋 Description

• Develop a secure, self-service developer sandbox within a regulated energy utility's Azure environment.

• Establish pooled Azure Virtual Desktop and Omnissa Horizon instant-clone desktops streamed over HTTPS 443.

• Conduct a proof of concept to determine the appropriate desktop platform.

• Preserve developer states utilizing FSLogix or Dynamic Environment Manager and App Volumes.

• Construct hub-and-spoke VNets isolated from production.

• Implement forced-tunnel egress via Azure Firewall Premium with TLS inspection and IDPS.

• Set up private endpoints and DNS configurations.

• Optimize inspection for Git, package managers, GitHub Copilot, and AI/MCP endpoints.

• Manage Azure Image Builder or Packer pipelines to the Azure Compute Gallery.

• Create, patch, harden according to CIS standards, scan, and distribute golden images.

• Oversee the maintenance of CarbonBlack App Control allow-lists and BeyondTrust EPM throughout rebuilds.

• Apply guardrails as code using Azure Policy and Terraform or Bicep.

• Set up a non-production identity tenant, project-specific RBAC, and Key Vault.

• Forward logs for firewall, desktop, and provisioning to Sentinel or Splunk.

• Develop ephemeral resource templates with TTL and a mechanism for orphaned-resource cleanup.

• Enable image pipelines to allow AXIOM AI agents to suggest promotions for human validation.

• Deliver architecture, runbooks, and a support framework.

⛳️ Requirements

• Bachelor’s degree in a relevant field (or equivalent practical experience).

• Over 8 years of experience in infrastructure or platform engineering.

• At least 4 years of hands-on Azure experience in an enterprise or regulated setting.

• Experience in production AVD or Omnissa/VMware Horizon deployments, including non-persistent pools, image lifecycle, and FSLogix or DEM/App Volumes at scale.

• Extensive knowledge of VNets, UDRs, Azure Firewall, Private Link, DNS, and NSGs.

• Proficient in troubleshooting broken TLS chains.

• Expertise in Terraform or Bicep through CI/CD processes.

• Familiarity with Packer or Azure Image Builder.

• Experience with Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy.

• Working knowledge of Windows 11 multi-session hardening and Linux for container workloads.

• Capability to produce clear technical designs validated by a Cyber Risk reviewer.

• Preferred certifications: AZ-104, AZ-700, AZ-140, AZ-305, Terraform Associate, VCP-DTM.

• Preferred experience in tuning CarbonBlack App Control, BeyondTrust EPM, CrowdStrike, or Defender for Endpoint for developer environments.

🏝️ Benefits

• Employees have the option to work remotely.

• Opportunities for continuous learning and development.

• A culture that promotes inclusivity and collaboration.

• Involvement in cutting-edge projects related to cloud-native architecture, automation, and AI/ML.