- Implement Azure Landing Zones following Microsoft CAF (Cloud Adoption Framework) and WAF (Well Architected Framework) best practices Defne and enforce Management Group hierarchy subscription design and governance policies using Azure Policy and Blueprints Design hub spoke or Virtual WAN topologies with ExpressRoute or VPN gateway integration
- Establish identity and access management strategy using Azure Active Directory PIM RBAC and Conditional Access policies Implement network segmentation NSGs Azure Firewall Private Endpoints UDRs and DNS architecture Drive adoption of enterprise grade security controls Microsoft Defender for Cloud Sentinel integration and security baselines (CIS NIST) Terraform Infrastructure as Code Write maintain and review production grade Terraform modules for all Azure Landing Zone components Develop reusable composable
- Terraform modules with clear interfaces variable validation and semantic versioning Manage remote state in Azure Blob Storage with state locking and workspace strategies for multi workplace deployments Implement Terraform testing frameworks (Terratest checkov tfsec) for policy as code compliance Define and maintain provider version constraints dependency graphs and upgrade runbooks CI or CD & Automation Build and maintain GitOps based CI or CD pipelines (Azure DevOps or GitHub Actions) for automated Landing Zone provisioning Implement pipeline stages for plan policy validation security scanning and apply with drift detection Automate compliance enforcement using Azure Policy initiatives and custom policy definitions in Terraform Develop operational runbooks and self service automation for common platform tasks Platform Engineering & Reliability
- Establish observability stack Azure Monitor Log Analytics Application Insights and alerting frameworks Design and implement cost governance guardrails budgets tagging policies and resource lifecycle management Lead disaster recovery design backup strategies and cross region fa