: Senior Azure Cloud & Security Engineer

Pathpresenter is hiring a Senior Azure Cloud & Security Engineer to own our Azure platform end to end: Terraform-managed AKS environments, identity in Entra ID, device management in Intune, and security monitoring in Microsoft Sentinel and Defender.

You will take our private AKS platform from one live UAT setting to a clean, modular dev / stage / prod setup, harden it, and run it day to day. The role reports to engineering leadership and works closely with our application and DevOps teams.

- Type: Full-time
- Location: hybrid
- Compensation: 85000 -95000

Key responsibilities
1. Own the AKS repo and refactor it into reusable modules for dev, UAT, stage and prod.
2. Build, upgrade and operate private AKS clusters (Azure CNI, node pools, autoscaling, KEDA, workload identity).
3. Run Azure networking: VNets, peering, VPN and NAT Gateway, private endpoints, private DNS, App Gateway for Containers with WAF.
4. Operate ACR, Key Vault, Storage, PostgreSQL Flexible Server and Azure Managed Redis, including backup and DR.
5. Run Terraform CI/CD in GitHub Actions with OIDC, and support ArgoCD and self-hosted runners.
6. Administer Entra ID: users, groups, SSO, Conditional Access, MFA, PIM, RBAC and managed identities.
7. Manage devices with Intune and Autopilot: enrollment, compliance, configuration profiles, apps and patching.
8. Run Microsoft Sentinel and Defender: analytics rules, KQL hunting, playbooks, incident response, Secure Score.
9. Keep secrets safe: rotate keys, move them to Key Vault, remove them from code; own cost, tagging and Azure Policy.
10. Support observability (Grafana, Loki, Azure Monitor), HIPAA/SOC 2 compliance, and write runbooks and docs.

Required qualifications
- 5+ years in cloud infrastructure or DevOps, with 3+ years focused on Microsoft Azure.




- Solid Terraform (azurerm, azuread providers): modules, remote state, multi-environment layouts.
- Hands-on production experience with AKS and Kubernetes: networking, node pools, upgrades, RBAC, workload identity.
- Solid Azure networking: VNets, peering, VPN Gateway, private endpoints, private DNS, NAT, WAF.
- Entra ID administration: Conditional Access, MFA, PIM, app registrations, RBAC and managed identities.
- Microsoft Intune: device enrollment, compliance and configuration policies, app deployment.
- Microsoft Sentinel and Defender: building analytics rules, triaging incidents, writing KQL.
- CI/CD with GitHub Actions or Azure DevOps, including OIDC federation to Azure.
- Scripting in PowerShell and Bash; Python is a plus.
- Clear written communication: you document what you build.

Preferred qualifications
- Experience in healthcare or other regulated industries (HIPAA, SOC 2, HITRUST).
- GitOps with ArgoCD and Helm; self-hosted GitHub runners (ARC).
- Grafana, Mimir, Loki or Prometheus-based observability.
- Azure Policy, management groups and landing zones (CAF).
- Azure Database for PostgreSQL, Azure Managed Redis, App Gateway for Containers.
- Checkov, tflint or other IaC security scanning.

Certifications (nice to have)

- AZ-104 Azure Administrator or AZ-305 Azure Solutions Architect
- AZ-500 Azure Security Engineer
- SC-200 Security Operations Analyst (Sentinel)




- SC-300 Identity and Access Administrator (Entra ID)
- MD-102 Endpoint Administrator (Intune)
- CKA / CKS (Kubernetes)
- HashiCorp Terraform Associate

Tools and tech stackArea

What we use

Infrastructure as Code

Terraform (azurerm), tflint, Checkov

Compute

AKS (private cluster, Azure CNI, KEDA, VPA), Azure Container Registry

Networking

VNets, peering, VPN Gateway, NAT Gateway, App Gateway for Containers + WAF, Private DNS

Data

PostgreSQL Flexible Server, Azure Managed Redis, Storage Accounts

Secrets

Azure Key Vault (RBAC, private endpoints)

Identity

Microsoft Entra ID, managed identities, workload identity federation

Endpoints

Microsoft Intune, Autopilot

Security

Microsoft Sentinel, Defender for Cloud / Containers / Endpoint

CI/CD

GitHub Actions (OIDC), ArgoCD, ARC runners; Azure DevOps (legacy)

Observability

Grafana, Mimir, Loki, Alloy, Azure Monitor, Log Analytics

What success looks likeFirst 30 days

- Learn the UAT environment, the Terraform repo and the CI pipelines.
- Rotate any hardcoded secrets (such as the VPN pre-shared key) and move them to Key Vault.
- Consolidate onto one CI system for Terraform applies.
- Baseline Entra ID, Intune and Sentinel: what's configured, what's missing.

By 60 days

- Dev and stage environments live from a shared Terraform module, with CI.
- Prod identities, state and DNS separated from non-prod.
- Conditional Access and Intune compliance policies enforced for all staff devices.
- Core Sentinel analytics rules and an incident runbook in place.

By 90 days

- Production AKS environment built and documented.
- Secure Score and Defender recommendations trending up, with a tracked backlog.
- Runbooks and README written so another engineer can operate the platform.

📌 Cloude DevOPS (Ahmedabad)
🏢 PathPresenter
📍 Ahmedabad