Senior Infrastructure Engineer – Secure Developer Platforms, Azure/VDI

This is a fully remote position, open to applicants in Virginia.

📋 Description

• Develop a secure, self-service developer sandbox within a regulated energy utility's Azure environment.

• Provide non-persistent, streamed desktops utilizing Azure Virtual Desktop and Omnissa Horizon.

• Conduct a proof of concept to determine the best solution between AVD and Omnissa Horizon.

• Preserve developer states using FSLogix or Dynamic Environment Manager along with App Volumes.

• Establish hub-and-spoke VNets that are segregated from production environments.

• Implement forced-tunnel egress via Azure Firewall Premium with TLS inspection and IDPS capabilities.

• Set up private endpoints and DNS configurations.

• Optimize inspection for Git, package managers, GitHub Copilot, and AI/MCP endpoints.

• Manage Azure Image Builder or Packer pipelines to the Azure Compute Gallery.

• Construct, patch, CIS-harden, scan, and publish golden images.

• Oversee CarbonBlack App Control allow-lists and BeyondTrust EPM throughout rebuilds.

• Enforce guardrails as code using Azure Policy and Terraform or Bicep.

• Configure a non-production identity tenant with per-project RBAC and Key Vault.

• Forward logs from firewalls, desktops, and provisioning to Sentinel or Splunk.

• Create ephemeral resource templates with TTL and an orphaned-resource reaper.

• Expose image pipelines to enable AXIOM AI agents to suggest promotions for human review.

• Deliver architecture documentation, runbooks, and a support framework.

⛳️ Requirements

• Bachelor's degree in a relevant field or equivalent practical experience.

• Over 8 years of experience in infrastructure or platform engineering.

• More than 4 years of hands-on experience with Azure in an enterprise or regulated setting.

• Experience deploying production AVD or Omnissa / VMware Horizon, including non-persistent pools, image lifecycle management, and FSLogix or DEM / App Volumes at scale.

• Extensive knowledge of VNets, UDRs, Azure Firewall Premium TLS inspection, Private Link, DNS, and NSGs.

• Proficient in troubleshooting issues with broken TLS chains.

• Expertise in Terraform or Bicep through CI/CD processes.

• Familiarity with Packer or Azure Image Builder.

• Knowledge of Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy.

• Working understanding of Windows 11 multi-session hardening and Linux for container workloads.

• Capability to articulate designs for Cyber Risk assessment and approval.

• Preferred certifications: AZ-104, AZ-700, AZ-140, AZ-305, Terraform Associate, VCP-DTM.

• Preferred experience in tuning CarbonBlack App Control, BeyondTrust EPM, CrowdStrike, or Defender for Endpoint for developer environments.

🏝️ Benefits

• Flexible remote work options.

• A culture that values inclusivity and collaboration.

• Opportunities for continuous learning and growth.