Experience: 10 – 12 Years

Required Skills

Microsoft Fabric Architecture, One Lake, Lakehouse, Warehouse, Direct Lake Azure Data Factory, Databricks, Synapse Analytics Medallion Architecture and Data Governance Azure Cloud Architecture, Landing Zones and Networking Security: Entra ID, RBAC, Purview, Key Vault DevSecOps, CI/CD, Terraform/Bicep Enterprise Data Migration and Modernization Architecture Leadership, Pre-Sales and Stakeholder Mana

Role summary

The Azure Architect is the design authority for enterprise data and analytics platforms built on Microsoft Fabric and Azure. You will define target-state architecture, landing zone and security guardrails, and the DevSecOps operating model that lets delivery teams ship Fabric workloads safely and repeatably. You will lead client-facing architecture, pre-sales solutioning and governance boards, and mentor senior engineers and specialists.

Key responsibilities

Architecture and design authority

- Define end-to-end target architecture for Microsoft Fabric: OneLake, Lakehouse, Warehouse, Data Factory pipelines, Dataflows Gen2, Notebooks/Spark, Real-Time Intelligence (Eventstream, Eventhouse/KQL), and Power BI semantic models using Direct Lake.
- Design medallion (bronze/silver/gold) and data-mesh patterns using Fabric domains, workspaces, OneLake shortcuts (ADLS Gen2, S3, GCS, Dataverse) and Mirroring (Azure SQL, Cosmos DB, Snowflake, Databricks catalogs).
- Own capacity strategy: F-SKU sizing, capacity separation (dev/test/prod, workload isolation), autoscale, smoothing and throttling behaviour, Capacity Metrics app monitoring and chargeback.
- Produce architecture decision records (ADRs), HLD/LLD,



reference architectures and non-functional requirements (availability, RPO/RTO, performance, cost).
- Lead migration architecture from Azure Synapse, Azure Data Factory, Databricks, SQL Server/SSIS, Power BI Premium (P-SKU) and on-premises warehouses to Fabric.
- Design Azure landing zones aligned to the Cloud Adoption Framework (CAF) and Well-Architected Framework: management group hierarchy, subscription vending, hub-spoke or Virtual WAN networking, Azure Firewall, Private DNS.
- Define network isolation for Fabric: Private Links (tenant and workspace level), Managed Private Endpoints, managed virtual networks, trusted workspace access, on-premises and VNet data gateways.
- Architect supporting services: ADLS Gen2, Azure SQL, Azure Event Hubs, Azure Functions, AKS/Container Apps, Azure OpenAI / AI Foundry integration with Fabric data agents and Copilot.
- Define identity model with Microsoft Entra ID: security groups, workspace roles, item permissions, OneLake security (role-based data access), row/column/object-level security, service principals and workspace identities, PIM and Conditional Access.
- Integrate Microsoft Purview: data map and scanning, Unified Catalog, sensitivity labels and label inheritance in Fabric, DLP policies, lineage and audit.




- Set encryption and key management standards: customer-managed keys, Azure Key Vault, managed identities, secret rotation.
- Map controls to regulatory frameworks (SOC 2, ISO 27001, PCI DSS, GDPR, DPDP Act, RBI/SEBI or industry equivalents) and lead security architecture reviews and threat modelling (STRIDE).
- Own Fabric tenant settings governance and admin-portal policy baseline.
- Define the secure SDLC for data workloads: branching strategy, Fabric Git integration (Azure DevOps Repos / GitHub), deployment pipelines (dev → test → prod), deployment rules and parameterisation.
- Standardise Infrastructure as Code with Terraform (azurerm, azapi and the Microsoft Fabric provider) and/or Bicep; define module registries, state management and policy-as-code (Azure Policy, OPA/Conftest, Sentinel).
- Define CI/CD reference pipelines on Azure DevOps or GitHub Actions using the Fabric REST APIs and the fabric-cicd Python library, with OIDC / workload identity federation (no long-lived secrets).
- Embed security gates: SAST (CodeQL, SonarQube), secret scanning (GitHub Advanced Security, Gitleaks), IaC scanning (Checkov, tfsec/Trivy), dependency/SCA scanning, container image scanning and SBOM generation.
- Define posture management with Microsoft Defender for Cloud (CSPM, DevOps security connectors), Microsoft Sentinel alerting and audit-log streaming.

Azure platform and landing zone

Security, governance and compliance

DevSecOps and platform engineering

Pay: ₹1,900,000.00 - ₹2,000,000.00 per year

Work Location: Hybrid remote in Bangalore City, Bengaluru, Karnataka

📌 Azure Architect (Bengaluru)
🏢 Classic Solutions
📍 Bengaluru