Azure Engineer

Senior Azure Infra Apps Platform Engineer - Assistant Manager- MFT - KGS CH Senior Azure Infra Apps Engineer Location: Offshore Function: Cloud Run Service Operations Type: Permanent, Full‑time Reports to: Service Ops Lead – Platform Services KPMG Overview Joining KPMG means joining a talented team of exceptional colleagues who bring innovative thoughts and a natural curiosity to the work they do each day. No one type of person succeeds at KPMG; a diverse business requires diverse personalities, characters and perspectives. There really is a place for you here. You will be working within Group Digital Platform Services Operations which services the broader Firm through delivery of core technology and managed services capabilities, collaboration and innovation development services and building our Alliances network. Key Responsibilities Cloud Platform Support Support and maintain highly available Windows Server workloads (2016/2019/2022) on Azure (VMs, VMSS, ASR, Azure Files, Azure Backup, Azure Site Recovery). Engineer core Microsoft services: Active Directory, Azure AD, Group Policy, DNS/DHCP, ADFS PKI/Certificates, IIS etc Operations & Reliability Own the stability, performance, and capacity of Wintel platforms and drive SRE-style reliability practices. Lead Major Incident technical bridge, perform root cause analysis (RCA), and implement problem management fixes. Patch, backup, and DR strategy execution (Azure Update Manager, Azure Backup, ASR); regularly test restores and DR playbooks. Monitoring/observability with Azure Monitor, Log Analytics, Microsoft Sentinel/Defender for Cloud. Security & Compliance Implement security baselines, CIS/Benchmarks, least privilege RBAC, JIT/JEA, Credential Guard, LAPS, and secure RDP patterns. Integrate with Sentinel for detection/response; support vulnerability remediation and compliance reporting (ISO 27001, SOC 2, Cyber Essentials Plus, GDPR). Manage certificates/PKI, TLS hardening, and secrets management (Key Vault) for Windows workloads. Collaboration & Leadership Act as a technical SME for projects; provide design reviews and sign‑off Mentor engineers; conduct knowledge transfers, create runbooks, and uplift standards. Partner with Networking, Security, and App teams on cross‑domain designs (e.g., hybrid connectivity, private endpoints, App Gateway/WAF, load balancers). Required Skills & Experience 8+ years administering Windows Server platforms; 3–5+ years hands‑on with Azure (IaaS and core PaaS for Windows workloads). Deep expertise in Active Directory (sites & services, trusts, GPO design, AD CS/PKI) and Entra ID (sync, SSO, conditional access concepts). Strong PowerShell (modules, functions, error handling), DSC, and infra automation (Bicep/ARM or Terraform). Proven track record with Azure networking for VMs: VNets, peering, Private DNS, NSGs/ASGs, load balancers, Application Gateway/WAF, ExpressRoute/VPN. Solid understanding of backup/DR patterns (RPO/RTO), clustering, and performance tuning for Windows workloads. Experience with observability (Log Analytics/KQL), security tooling (Defender for Cloud, Sentinel), and vulnerability remediation. Major Incident leadership, RCA/problem management, and stakeholder communication. Nice to Have SCCM/MECM, Azure Update Manager, WSUS at scale. SQL Server on Windows (Ops basics), IIS advanced config, SMB/NFS (Azure Files). Intune/Autopilot, conditional access, identity governance. Containers on Windows Server, AKS fundamentals, or Azure Arc for Servers. Scripting beyond PowerShell (Python) for tooling and data analysis. Experience in regulated environments (Financial Services, Public Sector, Healthcare). Certifications (Preferred) Microsoft Certified: Azure Administrator Associate (AZ‑104) Microsoft Certified: Windows Server Hybrid Administrator Associate (AZ‑800/801) Security: SC‑200/SC‑300 (nice to have) Tools & Technologies Azure: Compute (VMs/VMSS), Storage (Disks, Files), Networking, ASR, Backup, Key Vault, Monitor, Log Analytics, Defender for Cloud, Sentinel, Policy, Blueprints, Update Manager. Windows: Server 2016/2019/2022, AD DS, DNS/DHCP, GPO, AD CS/PKI, Failover Clustering, IIS, SMB. Automation/DevOps: PowerShell, DSC, Bicep/ARM (Terraform desirable), Azure DevOps/GitHub Actions, Azure Automation/Functions, Desired State, Pester. Mgmt/Config: MECM/SCCM, WSUS, Intune (desirable). Observability/SecOps: KQL, Sentinel, Defender for Cloud, MDE, SCOM (legacy familiarity a plus). Experience Level Senior Level