Senior Infrastructure Engineer — Secure Developer Platforms (Azure / VDI)
我们正在寻找一名高级基础设施工程师，以在监管能源公用事业 Azure 租户内部建立一个安全的自助开发者沙箱。你将提供非持久的流媒体桌面在 Azure 虚拟台和 Omnissa Horizon 上，每次登录时都会重新构建清洁，保持开发人员的工作，并在1分钟内启动中通过 TLS 检查出口发送所有流量。你将拥有从着陆区到黄金图像的堆。关键责任：· 非持久桌面：站起来组合 AVD 和 Omnisza Horizon （即时克隆）桌面流媒体 HTTPS 443;运行选择平台的头对头 POC; · 登陆区和检查的攻击：建立从生产中分段的枢纽和语音 VNets,通过 Azure Firewall Premium （TLS 检测，IDPS）,私人终端点和 DNS 进行强制通道输出；调整检查以便 Git,包管理器，GitHub Copilot 和 AI/MCP 终端点继续工作。· 金色图像与终端控制：拥有 Azure Image Builder 或 Packer 管道到 Azure Compute Gallery （构建，补丁，发布-硬化，扫描，CIS）;保持 CarbonBlack App Control 允许列表和 BeyondTrust EPM 在重建中运行。·身份证据，轨迹 &登录：执行保护作为 Azure Policy 和 Terraform 或 Bicep 的代码；将非生产身份租户，每个项目 RBAC 和 Key Vault 线索；向 Sentinel 或 Splunk 传输防火墙，桌面和储存日志。·自助服务，AI 代理人和交付：使用 TTL 和孤儿资源收获器构建短暂资源模板；暴露图像管道，以便 AXIOM 人工智能代理人可以提出人类批准的促销方案；提供架构，运行簿和支持模型。·相关领域 （或相当实践经验）的学士学位。· 8年以上基础设施或平台工程，包括4年的企业或监管 Azure 环境中的工程工作。·虚拟桌面：提供至少一个生产 AVD 或 Omnissa/VMware Horizon 部署，包括非持久的池，图像生命周期和 FSLogix 或 DEM / App Volumes 在规模上。· Azure 网络：与 VNets,UDR,Azure 火墙 （首选 Premium TLS 检查）,私人链接，DNS 和 NSG 进行深度经验，包括故障解决破碎的 TLS 链。· IaC & Identity:专家 Terraform 或 Bicep 通过 CI/CD 运行；Packer 或 Azure Image Builder;Entra ID,RBAC,PIM,管理身份，Key Vault,a
查看英文原文
We're looking for a Senior Infrastructure Engineer to build a secure, self-service developer sandbox inside a regulated energy utility's Azure tenant. You'll deliver non-persistent, streamed desktops on Azure Virtual Desktop and Omnissa Horizon that rebuild clean at every log off, keep developers' work, and send all traffic through TLS-inspected egress while still booting in under a minute. You'll own the stack from landing zone to golden image.
Key Responsibilities:
- Non-Persistent Desktops: Stand up pooled AVD and Omnissa Horizon (instant clone) desktops streamed over HTTPS 443; run the head-to-head POC that selects the platform; persist developer state with FSLogix or Dynamic Environment Manager and App Volumes.
- Landing Zone & Inspected Egress: Build hub-and-spoke VNets segmented from production, with forced-tunnel egress through Azure Firewall Premium (TLS inspection, IDPS), private endpoints, and DNS; tune inspection so Git, package managers, GitHub Copilot, and AI/MCP endpoints keep working.
- Golden Image & Endpoint Controls: Own the Azure Image Builder or Packer pipeline to Azure Compute Gallery (build, patch, CIS-harden, scan, publish); keep CarbonBlack App Control allow-lists and BeyondTrust EPM working across rebuilds.
- Identity, Guardrails & Logging: Enforce guardrails as code with Azure Policy and Terraform or Bicep; wire a non-production identity tenant, per-project RBAC, and Key Vault; forward firewall, desktop, and provisioning logs to Sentinel or Splunk.
- Self-Service, AI Agents & Handover: Build ephemeral resource templates with TTL and an orphaned-resource reaper; expose image pipelines so AXIOM AI agents can propose promotions that humans approve; deliver architecture, runbooks, and a support model.
- Bachelor's degree in a related field (or equivalent practical experience).
- 8+ years in infrastructure or platform engineering, including 4+ years of hands-on Azure in an enterprise or regulated environment.
- Virtual Desktop: Delivered at least one production AVD or Omnissa / VMware Horizon deployment, including non-persistent pools, image lifecycle, and FSLogix or DEM / App Volumes at scale.
- Azure Networking: Deep experience with VNets, UDRs, Azure Firewall (Premium TLS inspection preferred), Private Link, DNS, and NSGs, including troubleshooting broken TLS chains.
- IaC & Identity: Expert Terraform or Bicep run through CI/CD; Packer or Azure Image Builder; Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy.
- Working knowledge of Windows 11 multi-session hardening and Linux for container workloads; clear writer who can get a design approved by a Cyber Risk reviewer.
Nice to Have / Preferred Qualifications:
- Certifications: Azure: AZ-104, AZ-700, AZ-140, AZ-305; Terraform Associate; VCP-DTM.
- Tuning CarbonBlack App Control, BeyondTrust EPM, CrowdStrike, or Defender for Endpoint for developer workloads.
We Value:
- Drive: Passion and energy to implement quality technical solutions. Self-motivation and intellectual curiosity
- Commitment to Quality: Passion to conceive and produce world-class solutions that drive real-world value for the customer
- Customer Focus: Consultative approach to solving problems for customers. Expectations management.
- Communication: Superior communication skills. Ability to clearly articulate problems, solutions, risks, rewards etc. (written and verbal)
- Technical Skills: Love for technology. You have to be inherently passionate about technology.
- Business Acumen: Technology ultimately is used to enable the business. We look for people who understand how the businesses can be enabled through their technical solutions
All your information will be kept confidential according to EEO guidelines.
Oteemo is an industry-leading technology consulting firm at the forefront of AI-driven, cloud native, enterprise DevSecOps transformation. We build intelligent, automated, secure systems for organizations tackling their toughest technical and business challenges and we're pushing the boundaries of what AI, generative AI, and agentic systems can do in production, not just in theory. Join us and you'll work alongside recognized experts on cutting-edge projects that blend cloud native architecture, extreme automation, and AI/ML at the core. We foster a dynamic, inclusive, and collaborative culture built on continuous learning, where your ideas shape real outcomes for our clients. If you're passionate about building what's next in AI and cloud technology and want to do it with a team that sets the standard rather than follows it, Oteemo is where you belong.
Originally posted on Himalayas