Senior Azure Cloud Architect

Own the Azure architecture for a federal agency in Washington, DC: design the enterprise landing zone, write and review the infrastructure as code that builds it, and defend the design in front of senior leadership.

About the role

Innosoft Corporation is hiring a Senior Azure Cloud Architect to support a federal agency's technology office, which operates and continues to modernize its enterprise environment on Microsoft Azure. You will own the design, governance, security posture and migration of workloads across Azure compute, storage, networking, identity, data and integration services.

This position requires deep hands-on Azure engineering and architecture-level design in one person. You will produce reference architectures, diagrams and architecture decision records that engineering teams can implement directly, define infrastructure as code standards for the team, lead architecture review boards and design authority meetings, and drive enterprise-scale landing zone design and governance aligned to the Microsoft Cloud Adoption Framework and the Azure Well-Architected Framework.

You will be comfortable translating business requirements into technical designs and presenting solution designs and tradeoffs to CIOs, CTOs and senior leadership.

Scale and context

• Enterprise Microsoft Azure environment spanning compute, storage, networking, identity, data and integration services
• Active modernization program, including workload migration and large-scale datacenter exit planning
• Initial 2-year contract term with possible extension
• You lead a team of engineers and work alongside federal staff and other contractors
• Start date: immediate

Location and schedule

• Local candidates only. This is a hybrid role with one day per week on-site in Washington, DC. On-site attendance is mandatory.
• You must currently live in the Washington, DC metropolitan area (DC, Maryland or Northern Virginia) and be able to report on-site every week. We are not considering relocation or fully remote candidates for this role.
• The remainder of the week is remote.
• Interviews are conducted by Microsoft Teams.
• Full-time W2 employment with Innosoft Corporation.

What you will do

Architecture and design

• Design enterprise-scale Azure solutions across Virtual Machines, VM Scale Sets, App Services, Azure Functions, Container Apps, AKS and Azure Batch, selecting the right option for each workload
• Architect advanced Azure networking across Virtual Networks, NSGs, UDRs, Private Endpoints, Load Balancer, Application Gateway, Azure Firewall, Front Door, Virtual WAN, ExpressRoute and VPN Gateway, including hub and spoke topologies and enterprise DNS strategy
• Design identity architecture using Microsoft Entra ID, including Conditional Access, Privileged Identity Management, B2B and B2C scenarios, federation with on-premises Active Directory, managed identities and RBAC
• Apply the Azure Well-Architected Framework across reliability, security, cost optimization, operational excellence and performance efficiency
• Design multi-region, highly available and disaster-resilient solutions with defined recovery time and recovery point objectives
• Produce reference architectures, diagrams and architecture decision records that an engineering team can implement directly

Migration and modernization

• Implement Cloud Adoption Framework practices, including enterprise-scale landing zone design and governance blueprints
• Lead workload assessments using Azure Migrate and map applications to the five Rs: rehost, refactor, rearchitect, rebuild and replace
• Perform wave planning for large-scale datacenter exits, including dependency mapping and cutover planning

Engineering and automation

• Define infrastructure as code standards and repository structure for the team, and review and validate Bicep or Terraform code written by others
• Build and maintain CI/CD pipelines in Azure DevOps or GitHub Actions, including artifact management, secret scanning and pipeline security hardening
• Implement release strategies including blue and green, canary and ring-based deployments
• Operate production AKS clusters, including upgrades, node pool management and networking through Azure CNI or Calico, with Helm chart authoring and GitOps workflows using Flux or ArgoCD

Security, operations and cost

• Implement security, compliance and governance using Microsoft Defender for Cloud, Microsoft Sentinel and Key Vault with secret rotation, together with Azure Policy, Management Groups and Blueprints, applying Zero Trust principles across identity, network and data layers
• Configure Azure Monitor, Log Analytics and Application Insights, and author KQL queries for diagnostics, alerting and dashboards
• Provide incident command, including root cause analysis and capacity planning at scale
• Drive FinOps practices using Azure Cost Management, reserved instances, savings plans and rightsizing, and build total cost of ownership and return on investment models for executive stakeholders

Leadership and collaboration

• Lead a team of engineers, including task assignment and design reviews with clear, constructive feedback
• Lead architecture review boards and design authority meetings, and facilitate discovery workshops with business and technical stakeholders
• Mentor engineers and architects on design patterns and troubleshooting technique
• Work with federal and contractor personnel to execute project tasks, and collaborate with agency staff to refine and elaborate requirements

Requirements

What you need

• Local to the Washington, DC metropolitan area and able to work on-site in Washington, DC one day per week (mandatory)
• 9 to 15 years of total IT experience, including at least 5 to 7 years of hands-on Azure engineering and at least 2 to 4 years at an architecture or technical leadership level
• A career path that progressed from hands-on engineering into architecture, since this position requires both skill sets in one person
• Advanced, hands-on expertise across Azure compute services, including Virtual Machines, VM Scale Sets, App Services, Azure Functions, Container Apps, AKS and Azure Batch
• Full lifecycle knowledge of Blob Storage, Azure Files, Managed Disks and storage lifecycle management policies
• Advanced enterprise-level Azure networking experience, including hub and spoke design and DNS strategy
• Identity expertise covering Microsoft Entra ID administration and architecture, including Conditional Access, Privileged Identity Management, B2B and B2C, federation, managed identities and RBAC design
• Data platform experience across Azure SQL, Cosmos DB, PostgreSQL Flexible Server, Synapse Analytics, Microsoft Fabric and Data Lake Storage, from both an administration and a solution design perspective
• Integration services knowledge including API Management, Service Bus, Event Grid, Event Hubs and Logic Apps
• Deep mastery of the Azure Well-Architected Framework and fluency with the Cloud Adoption Framework
• Expert-level, hands-on proficiency in Bicep or Terraform, including module design, state management and reusable patterns
• Working knowledge of ARM templates for legacy or complex deployments
• Strong scripting ability in PowerShell, Bash and Python for automation and validation
• Production experience operating AKS, including upgrades, node pool management and networking through Azure CNI or Calico
• Hands-on experience with Microsoft Defender for Cloud, Microsoft Sentinel and Key Vault, including secret rotation practices
• Governance design using Azure Policy, Management Groups and Blueprints
• Advanced configuration of Azure Monitor, Log Analytics and Application Insights, with strong KQL query writing
• Practical experience with Azure Cost Management, reserved instances, savings plans and rightsizing
• Clear written and verbal communication, including polished design documentation, with strong stakeholder management, negotiation and the ability to influence without direct authority

Minimum education

Degree in Computer Science or a related field.

Preferred qualifications

• Background in Windows Server, Linux administration or virtualization platforms such as VMware, which is valuable for migration and hybrid scenarios
• Exposure to a regulated industry such as financial services, healthcare or government
• Hybrid architecture experience using Azure Arc, Azure Stack HCI and Azure Stack Edge
• Application modernization expertise, including microservices, event-driven architectures, serverless patterns and strangler fig migrations
• Familiarity with frameworks such as the CIS Azure Benchmark, NIST 800-53, FedRAMP, HIPAA or PCI DSS
• Working knowledge of service mesh concepts through Istio or Open Service Mesh
• Understanding of Enterprise Agreement, Microsoft Customer Agreement and bring-your-own-license structures
• Experience with Agile/Scrum development environments
• Experience working with cross-functional teams in a federal or regulated environment
• An ownership mentality and comfort operating with ambiguity

Certifications

• Required: AZ-305, Azure Solutions Architect Expert
• Required: AZ-104, Azure Administrator Associate
• Required: AZ-500, Azure Security Engineer Associate
• Preferred: AZ-700, Azure Network Engineer Associate
• Preferred: SC-100, Cybersecurity Architect Expert
• Preferred: CKA, Certified Kubernetes Administrator

Benefits

Benefits

Standard Employee Benefits.

50% Health Insurance Paid by Innosoft, Paid Vacation, 401K Match, STD LTD and AD&D paid by Innosoft.

Compensation

The salary range for this position is $155,000 to $160,000 annually. Actual compensation is determined by experience, qualifications, skills, location and internal equity. This range reflects the anticipated base salary and does not include bonus, benefits or other compensation.

Equal Employment Opportunity

Innosoft Corporation is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, physical or mental disability, genetic information, marital status, protected veteran status, or any other characteristic protected by applicable federal, state or local law.

As a federal contractor, Innosoft Corporation complies with its applicable equal employment opportunity and affirmative action obligations, including Section 503 of the Rehabilitation Act of 1973 and the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA).

Reasonable accommodation. If you need a reasonable accommodation to complete any part of the application or interview process, please contact recruitment@innosoft.com and we will work with you.

Employment is contingent upon successful completion of a background investigation, drug screening and reference checks in accordance with Innosoft Corporation policy.