SENIOR DEVOPS ENGINEER

The Senior DevOps Engineer is responsible for designing, deploying, automating, securing, and operating NEMS cloud infrastructure in Microsoft Azure. This is an infrastructure-focused DevOps role for an engineer with a strong enterprise networking foundation who can translate architecture and security requirements into repeatable Infrastructure as Code (IaC), deployment pipelines, policy controls, and operational runbooks.

The role builds and maintains Azure landing zones, management group and subscription structures, resource groups, network security groups, routing, connectivity, identity and policy guardrails, monitoring, and shared platform services across hybrid environments. Working closely with Systems, Network, Security, Application, and vendor teams, the engineer helps NEMS deliver secure, resilient, auditable, and HIPAA-aligned cloud services while reducing manual configuration and deployment risk.

ESSENTIAL JOB FUNCTIONS:

• Designs, implements, and maintains Azure landing zones using Microsoft Cloud Adoption Framework and Azure Well-Architected principles, including management groups, subscriptions, resource groups, naming standards, tagging, policy assignments, budgets, and centralized logging.
• Develops and maintains reusable Infrastructure as Code modules using Terraform and/or Bicep for Azure networking, security, compute, storage, monitoring, identity integration, and shared platform services.
• Builds and operates CI/CD pipelines in Azure DevOps and/or GitHub Actions to validate, plan, approve, deploy, and roll back infrastructure changes across development, test, disaster recovery, and production environments.
• Implements code review, branch protection, version control, state management, drift detection, automated testing, documentation, and release controls for infrastructure repositories.
• Designs and automates resource groups, virtual networks, subnets, network security groups, application security groups, route tables, Azure Firewall policies, private endpoints, Private DNS zones, load balancers, and application gateways.
• Designs and troubleshoots hybrid connectivity using ExpressRoute, site-to-site VPN, BGP, hub-and spoke and/or Azure Virtual WAN architectures, ensuring secure routing, segmentation, resiliency, and predictable failover.
• Applies network engineering fundamentals including TCP/IP, DNS, DHCP, BGP, NAT, routing, firewall policy, TLS, proxy, packet capture, traffic-flow analysis, and root cause analysis to Azure infrastructure issues.
• Implements Azure Policy initiatives, RBAC, managed identities, service principals, privileged access controls, secrets management, and least-privilege deployment patterns in coordination with the Security team.
• Embeds security checks into infrastructure pipelines, including IaC scanning, secrets detection, policy validation, configuration compliance, and controlled exception handling.
• Configures Azure Monitor, Log Analytics, Network Watcher, alerts, dashboards, diagnostic settings, and activity-log retention to improve visibility, incident response, capacity planning, and audit readiness.
• Supports Azure migration and modernization activities through discovery, dependency mapping, network readiness, landing-zone onboarding, workload placement, cutover planning, validation, and post-migration stabilization.
• Designs infrastructure for availability, backup, disaster recovery, and regional resilience based on approved recovery time and recovery point objectives; participate in failover and recovery testing.
• Automates recurring operational tasks using PowerShell, Azure CLI, Python, REST APIs, and configuration-management tools where appropriate.
• Maintains current architecture diagrams, module documentation, pipeline standards, operating procedures, troubleshooting guides, configuration records, and recovery runbooks.
• Participates in incident response, problem management, root cause analysis, corrective action planning, change management, and rotating on-call support for critical infrastructure services.
• Collaborates with internal teams, Microsoft, cloud service providers, carriers, managed service providers, and other vendors; validates technical deliverables and ensures changes meet NEMS architecture, security, and support requirements.
• Mentors infrastructure and network team members in IaC, Git workflows, cloud networking, automation, and operational practices.
• Evaluates cloud services and engineering practices, recommends improvements, and identifies opportunities to improve reliability, security, deployment speed, standardization, and cost governance.
• Performs other job duties as required by manager/supervisor.
• Bachelor's degree in Computer Science, IT, Network Engineering, a related STEM field, or equivalent experience
• 5 years enterprise infrastructure/network engineering experience with hands on responsibility for routing, firewalls, segmentation, DNS, VPN, and hybrid connectivity.
• 3 years hands on Microsoft Azure infrastructure engineering experience in production environments.
• Demonstrated provisioning of Azure infrastructure using Terraform and/or Bicep (reusable modules, remote state, variables/outputs, environment promotion).
• Experience building infra deployment pipelines (Azure DevOps and/or GitHub Actions) with approvals, security checks, and controlled production releases.
• Hands on experience with Azure networking: Virtual Network, NSGs, route tables, Azure Firewall, VPN Gateway, ExpressRoute, Private Link, Private DNS, load balancers, and network troubleshooting.
• Working knowledge of Microsoft Entra ID, Azure RBAC, managed identities/service principals, Key Vault, Azure Policy, and privileged access concepts.
• Experience supporting highly available, regulated, or mission critical environments; strong troubleshooting, documentation, communication, and cross team collaboration skills.
• Ability to translate architecture and governance standards into tested, reusable infrastructure code while maintaining separation of duties, controlled approvals, and auditability.

LANGUAGE:

• Must be able to read, write and speak English.
• Ability to speak and/or understand Chinese (Cantonese or Mandarin) is an asset.

STATUS:

• This is a FLSA non-exempt position.
• This is not an OSHA high-risk position.
• This is a Full Time position.

NEMS BENEFITS: Competitive benefits, including free medical, dental and vision insurance for employee, spouse and/or children; and company contribution to 401(k).

#LI-DNI