Azure landing zones and governance

- Design and deploy Azure landing zones aligned to the Cloud Adoption Framework (CAF) and Azure Landing Zone (ALZ) reference architecture.
- Build management group hierarchies, platform subscriptions (identity, management, connectivity) and subscription vending for application landing zones.
- Implement policy-driven governance with Azure Policy initiatives (deny, audit, modify, deployIfNotExists), managed as code.
- Define and enforce naming, tagging, RBAC and resource organisation standards across customer tenants.
- Customise the ALZ Bicep or Terraform accelerators and Azure Verified Modules to each customer’s requirements.
- Map controls to UAE requirements where they apply: UAE IA Regulation, DESC ISR, ADHICS, UAE PDPL and in-country data residency (UAE North, UAE Central).
- Run Well-Architected reviews and landing zone health checks on existing estates, then lead the remediation.

Azure Virtual Desktop (AVD)
- Design and deploy AVD end to end: pooled and personal host pools, application groups, workspaces, RemoteApp and full desktops.
- Build golden images with Azure Compute Gallery and Azure VM Image Builder, and run the monthly image update cycle.
- Implement FSLogix profile containers on Azure Files or Azure NetApp Files, sized for IOPS, capacity and availability.
- Configure scaling plans, Start VM on Connect and VM sizing to balance user experience against cost.
- Deliver applications through App Attach and Windows multi-session images with Microsoft 365 Apps and optimised Teams.
- Secure AVD with Conditional Access, MFA, Entra join or hybrid join, Intune, RDP property controls, screen capture protection and watermarking.
- Resolve L3 issues such as connection failures, agent faults, FSLogix profile locks, black screens and slow logons, using AVD Insights and KQL.
- Lead migrations to AVD from Citrix, Omnissa Horizon (formerly VMware Horizon) or Remote Desktop Services.

Azure networking
- Design hub-and-spoke and Virtual WAN topologies, including IP address planning, segmentation and routing.
- Implement hybrid connectivity with ExpressRoute (redundant circuits, private peering, Global Reach) and site-to-site or point-to-site VPN with BGP.
- Deploy and operate Azure Firewall Premium and Firewall Manager,



or third-party NVAs such as Palo Alto and Fortinet in highly available designs.
- Engineer routing with route tables, Azure Route Server and forced tunnelling, and resolve asymmetric routing.
- Design hybrid DNS for private endpoints using Private DNS zones and Azure DNS Private Resolver.
- Publish applications securely through Application Gateway WAF v2, Azure Front Door, Load Balancer and Private Link.
- Troubleshoot with Network Watcher, VNet flow logs, Traffic Analytics, connection troubleshoot and packet capture.

Security and identity
- Configure Microsoft Entra ID: hybrid identity (Entra Connect or Cloud Sync), Conditional Access, MFA, Privileged Identity Management and Identity Protection.
- Apply least-privilege Azure RBAC and custom roles, using managed identities and workload identity federation instead of stored secrets.
- Deploy and tune Microsoft Defender for Cloud (CSPM and workload protection plans), and raise secure score and compliance ratings.
- Onboard Microsoft Sentinel data connectors, and tune analytics rules and automation playbooks with the SOC team.
- Enforce Zero Trust controls: private endpoints, disabled public access, Azure Bastion, just-in-time VM access and DDoS Protection.
- Manage keys, secrets and certificates in Azure Key Vault or Managed HSM, including customer-managed key encryption.
- Remediate findings from vulnerability scans, penetration tests and compliance audits.

DevOps, infrastructure as code and automation
- Build reusable Terraform and Bicep modules for landing zones, networking, AVD and workloads, version-controlled in Git.
- Design CI/CD pipelines in Azure DevOps or GitHub Actions with plan and what-if stages, approvals, environments and drift detection.
- Secure pipelines with workload identity federation, Key Vault-referenced secrets, branch policies and peer review.
- Add IaC and policy checks to pipelines, such as PSRule for Azure, Checkov and TFLint.




- Automate operations with PowerShell, Azure CLI, Python, Azure Automation, Azure Functions and Logic Apps.
- Deploy and support AKS clusters at platform level: networking, identity, ingress, upgrades and container registry.

Qualified services delivery and migrations
- Lead technical delivery from discovery to handover: workshops, assessments, HLD/LLD, build, testing, go-live and hypercare.
- Run migrations with Azure Migrate: discovery, dependency analysis, wave planning, replication, test failover, cutover and rollback.
- Estimate effort and define technical scope for statements of work, and raise delivery risks early with the project manager.
- Lead design sessions with customer stakeholders and obtain design sign-off before build.
- Implement changes through the customer’s change process, with tested implementation and rollback plans.
- Hand over as-built documentation, runbooks and knowledge transfer so managed services can operate the estate from day one.

L3 operations and managed services
- Act as the final internal escalation point for P1/P2 incidents across compute, networking, identity, AVD and security.
- Lead major incident bridges: restore service, coordinate teams and give customers clear, timely updates.
- Own problem management: deliver root cause analyses (RCAs) with permanent fixes and preventive actions.
- Raise and drive Microsoft support cases through Unified Support or CSP partner channels.
- Implement high-risk changes, and review L2 changes as technical approver at the change advisory board (CAB).
- Manage delegated multi-tenant access through Azure Lighthouse and Partner Center GDAP on least privilege.
- Design monitoring with Azure Monitor, Log Analytics (KQL), Azure Monitor Agent, data collection rules, workbooks and action groups.
- Run backup and DR with Azure Backup and Azure Site Recovery, including restore tests and DR drills against agreed RPO/RTO.
- Manage patching and hybrid servers with Azure Update Manager and Azure Arc.
- Drive FinOps: rightsizing, reservations, savings plans, Azure Hybrid Benefit, budgets and cost anomaly alerts.
- Present monthly service reviews covering incidents, SLA performance, security posture, cost and improvement actions.

📌 Azure Cloud Engineer (Visakhapatnam)
🏢 Intertec Systems
📍 Visakhapatnam