Senior Infrastructure Engineer — Secure Developer Platforms (Azure / VDI)

We're looking for a Senior Infrastructure Engineer to build a secure, self-service developer sandbox inside a regulated energy utility's Azure tenant. You'll deliver non-persistent, streamed desktops on Azure Virtual Desktop and Omnissa Horizon that rebuild clean at every log off, keep developers' work, and send all traffic through TLS-inspected egress while still booting in under a minute. You'll own the stack from landing zone to golden image. 

Key Responsibilities:

• Non-Persistent Desktops: Stand up pooled AVD and Omnissa Horizon (instant clone) desktops streamed over HTTPS 443; run the head-to-head POC that selects the platform; persist developer state with FSLogix or Dynamic Environment Manager and App Volumes. 
• Landing Zone & Inspected Egress: Build hub-and-spoke VNets segmented from production, with forced-tunnel egress through Azure Firewall Premium (TLS inspection, IDPS), private endpoints, and DNS; tune inspection so Git, package managers, GitHub Copilot, and AI/MCP endpoints keep working. 
• Golden Image & Endpoint Controls: Own the Azure Image Builder or Packer pipeline to Azure Compute Gallery (build, patch, CIS-harden, scan, publish); keep CarbonBlack App Control allow-lists and BeyondTrust EPM working across rebuilds. 
• Identity, Guardrails & Logging: Enforce guardrails as code with Azure Policy and Terraform or Bicep; wire a non-production identity tenant, per-project RBAC, and Key Vault; forward firewall, desktop, and provisioning logs to Sentinel or Splunk. 
• Self-Service, AI Agents & Handover: Build ephemeral resource templates with TTL and an orphaned-resource reaper; expose image pipelines so AXIOM AI agents can propose promotions that humans approve; deliver architecture, runbooks, and a support model. 

• Bachelor's degree in a related field (or equivalent practical experience). 
• 8+ years in infrastructure or platform engineering, including 4+ years of hands-on Azure in an enterprise or regulated environment. 
• Virtual Desktop: Delivered at least one production AVD or Omnissa / VMware Horizon deployment, including non-persistent pools, image lifecycle, and FSLogix or DEM / App Volumes at scale. 
• Azure Networking: Deep experience with VNets, UDRs, Azure Firewall (Premium TLS inspection preferred), Private Link, DNS, and NSGs, including troubleshooting broken TLS chains. 
• IaC & Identity: Expert Terraform or Bicep run through CI/CD; Packer or Azure Image Builder; Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy. 
• Working knowledge of Windows 11 multi-session hardening and Linux for container workloads; clear writer who can get a design approved by a Cyber Risk reviewer. 

Nice to Have / Preferred Qualifications:

• Certifications: Azure: AZ-104, AZ-700, AZ-140, AZ-305; Terraform Associate; VCP-DTM. 
• Tuning CarbonBlack App Control, BeyondTrust EPM, CrowdStrike, or Defender for Endpoint for developer workloads.