[Hiring] Senior Infrastructure Engineer @Oteemo, Inc

Role Description

We're looking for a Senior Infrastructure Engineer to build a secure, self-service developer sandbox inside a regulated energy utility's Azure tenant. You'll deliver non-persistent, streamed desktops on Azure Virtual Desktop and Omnissa Horizon that rebuild clean at every log off, keep developers' work, and send all traffic through TLS-inspected egress while still booting in under a minute. You'll own the stack from landing zone to golden image.

• Non-Persistent Desktops: Stand up pooled AVD and Omnissa Horizon (instant clone) desktops streamed over HTTPS 443; run the head-to-head POC that selects the platform; persist developer state with FSLogix or Dynamic Environment Manager and App Volumes.
• Landing Zone & Inspected Egress: Build hub-and-spoke VNets segmented from production, with forced-tunnel egress through Azure Firewall Premium (TLS inspection, IDPS), private endpoints, and DNS; tune inspection so Git, package managers, GitHub Copilot, and AI/MCP endpoints keep working.
• Golden Image & Endpoint Controls: Own the Azure Image Builder or Packer pipeline to Azure Compute Gallery (build, patch, CIS-harden, scan, publish); keep CarbonBlack App Control allow-lists and BeyondTrust EPM working across rebuilds.
• Identity, Guardrails & Logging: Enforce guardrails as code with Azure Policy and Terraform or Bicep; wire a non-production identity tenant, per-project RBAC, and Key Vault; forward firewall, desktop, and provisioning logs to Sentinel or Splunk.
• Self-Service, AI Agents & Handover: Build ephemeral resource templates with TTL and an orphaned-resource reaper; expose image pipelines so AXIOM AI agents can propose promotions that humans approve; deliver architecture, runbooks, and a support model.

Qualifications

• Bachelor's degree in a related field (or equivalent practical experience).
• 8+ years in infrastructure or platform engineering, including 4+ years of hands-on Azure in an enterprise or regulated environment.
• Virtual Desktop: Delivered at least one production AVD or Omnissa / VMware Horizon deployment, including non-persistent pools, image lifecycle, and FSLogix or DEM / App Volumes at scale.
• Azure Networking: Deep experience with VNets, UDRs, Azure Firewall (Premium TLS inspection preferred), Private Link, DNS, and NSGs, including troubleshooting broken TLS chains.
• IaC & Identity: Expert Terraform or Bicep run through CI/CD; Packer or Azure Image Builder; Entra ID, RBAC, PIM, managed identities, Key Vault, and Azure Policy.
• Working knowledge of Windows 11 multi-session hardening and Linux for container workloads; clear writer who can get a design approved by a Cyber Risk reviewer.

Requirements

• Certifications: Azure: AZ-104, AZ-700, AZ-140, AZ-305; Terraform Associate; VCP-DTM.
• Tuning CarbonBlack App Control, BeyondTrust EPM, CrowdStrike, or Defender for Endpoint for developer workloads.

Benefits

• Drive: Passion and energy to implement quality technical solutions. Self-motivation and intellectual curiosity.
• Commitment to Quality: Passion to conceive and produce world-class solutions that drive real-world value for the customer.
• Customer Focus: Consultative approach to solving problems for customers. Expectations management.
• Communication: Superior communication skills. Ability to clearly articulate problems, solutions, risks, rewards etc. (written and verbal).
• Technical Skills: Love for technology. You have to be inherently passionate about technology.
• Business Acumen: Technology ultimately is used to enable the business. We look for people who understand how the businesses can be enabled through their technical solutions.