Senior Azure Cloud Architect

**Role Information:** - Job Title: Senior Azure Cloud Architect - Work Location: Fully remote position, home office - Employment Type: Full-time - Employment Status: Exempt, salaried - Visa sponsorship is **not** available for this position. - Must reside in the United States. - We are **not** accepting applicants for remote workers in California, Illinois, and New York at this time. # **Alignment with Corporate Values:** All Cutsforth employees are expected to perform their work in a manner that exhibits understanding and adherence to the Company Mission and Core Attributes of Cutsforth Employees. Employees in management roles must exhibit continual improvement along Cutsforth’s Leadership Traits. Further, each employee must read and adhere to corporate policies and safety protocols. - Learn more about Cutsforth here: Cutsforth.com/About - Read our Mission & Values here: Cutsforth.com/Values **Compensation:** - $135,735 - $168,093, depending on years of experience # **Role Overview:** Designs, governs, and optimizes Cutsforth’s enterprise Azure cloud platform, establishing the landing zones, network topology, identity model, and security controls that host the company’s software and data products. Partners with software engineering, security, and operations to deliver scalable, secure, and cost-effective cloud architecture that supports Cutsforth’s connected monitoring and industrial product offerings. **Key Responsibilities:** - Design and maintain Azure Landing Zones using the Cloud Adoption Framework (CAF) Enterprise-Scale, including management group hierarchy, subscription vending, and policy-driven governance - Build and maintain Infrastructure as Code using Terraform (Azure Verified Modules) and/or Bicep, with reusable modules, managed state, and CI/CD-driven deployments - Architect hub-and-spoke and Virtual WAN network topologies using Azure Firewall Premium, Private Link/Private Endpoints, NSGs, UDRs, and hybrid connectivity (ExpressRoute, VPN Gateway) - Design and operate production Azure Kubernetes Service (AKS) clusters, including Azure CNI networking, workload identity, autoscaling, and GitOps delivery (Flux/ArgoCD) - Implement identity and access architecture with Microsoft Entra ID (Conditional Access, PIM, managed identities), Entra External ID for customer identity, and RBAC at scale - Establish security and compliance tooling using Microsoft Defender for Cloud, Microsoft Sentinel (SIEM/SOAR), Azure Policy, Key Vault, and Defender for Containers/Servers - Map cloud architecture to compliance frameworks such as SOC 2, ISO 27001, FedRAMP, and IEC 62443, and support audit and remediation efforts - Drive cost optimization and FinOps practices, including reservations, savings plans, tagging strategy, and chargeback/showback models - Build observability across the platform using Azure Monitor, Log Analytics, Application Insights, and author KQL queries for monitoring and troubleshooting - Lead Well-Architected Framework reviews and strengthen DevOps pipelines (GitHub Actions / Azure DevOps), branch strategy, secrets management, and supply-chain security (SBOM, signed artifacts) **Required Qualifications:** - Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent professional experience - **8-12** years of cloud engineering experience, including 5+ years architecting production Azure environments at enterprise scale - Deep expertise with Azure Landing Zones and the Cloud Adoption Framework (CAF) Enterprise-Scale, including management group hierarchy, subscription vending, and policy-driven governance - Infrastructure as Code mastery with Terraform (Azure Verified Modules) and/or Bicep, including reusable module design, state management, and CI/CD-driven deployments - Strong Azure networking experience: hub-and-spoke and Virtual WAN topologies, Azure Firewall Premium, Private Link/Private Endpoints, NSGs, UDRs, and hybrid connectivity (ExpressRoute, VPN Gateway) - Production Azure Kuber…