About Our Client
Our client is a Government Owned Corporation in the Utilities space.
Brisbane based candidates only. 2/3 hybrid environment. 6 month initial contract with view to extend.
Job Description Cloud Uplift delivery (approximately 60% of time)
* Author and review Bicep IaC for platform and workload landing zones, using Azure Verified Modules where available, aligned to the HLA management group and subscription topology.
* Operate the EPAC repository for SEQ: contribute new policy assignments, manage exemption lifecycle, run the release pipeline, and produce non-compliance and remediation reporting at agreed cadence.
* Pair with the Lead SI partner on platform package delivery: code review, deployment validation, ADR co-authoring, and acceptance of handover artefacts (runbooks, READMEs, pipeline documentation).
* Stand up and tune diagnostic settings end-to-end: every in-scope resource emits to the Platform Log Analytics Workspace per the Logging Standard, with the diag- naming pattern, all log categories enabled by default, and 7-year retention enforced via policy.
* Roll out Defender for Cloud plans across CSPM, Servers Plan 2, Storage, Key Vault, SQL, Containers, App Service, and APIs in line with the standard, deployed via Bicep rather than DINE policy.
* Build and harden Microsoft Sentinel coverage: data connectors, analytics rules, automation rules, workbooks, and incident response runbooks aligned to SEQ playbooks.
BAU enablement (approximately 30% of time)
* Steward the Azure DevOps tenancy: organisation settings, project structure, the seven-repository plt-/wl- pattern, branch protection, build validation, service connection hygiene, and Managed DevOps Pool agents in the shared services subscription.
* Mature the SEQ DevOps engineering practices: pull request standards, peer review checklists, Bicep linting and pre-commit hooks, secret-scanning, dependency management, and pipeline templates as reusable YAML.
* Coach and uplift the BAU team: pair-programming, code review feedback, brown‐bag sessions, and knowledge artefacts on Bicep, EPAC, AVM, and Sentinel KQL.
* Operate the on‐call rotation for platform‐impacting incidents (after a documented onboarding period); contribute to post‐incident reviews and apply the lessons back into the platform code.
Standards and governance (approximately 10% of time)
* Act as the engineering reviewer for changes to the Naming, RBAC, Tagging, Logging, and HLA standards.
* Feed back operational lessons into the standards working group; draft proposed amendments with worked examples and policy impact analysis.
* Maintain the Architecture Decision Record (ADR) log for platform‐engineering decisions; ensure decisions are linked from the relevant Bicep modules, pipelines, and runbooks.
The Successful Applicant Required Experience
* Minimum 7 years of cloud engineering experience, of which at least 4 years on Azure as the primary platform.
* Demonstrable experience delivering an Azure Landing Zone, ideally aligned to the Microsoft Cloud Adoption Framework, including management group hierarchy design, subscription democratisation patterns, and platform‐versus‐workload separation.
* Production experience authoring Bicep at scale, including consumption of Azure Verified Modules (AVM) for Bicep and contribution back to a customer module library.
* Production experience with Azure DevOps Pipelines as the CI/CD platform: YAML pipelines, environments and approvals, service connections, variable groups linked to Key Vault, Managed DevOps Pools, and OIDC or workload identity federation.
* Working experience with Azure Policy at scale, including custom policy authoring, initiative composition, and exemptions. Hands‐on experience with Enterprise Policy as Code (EPAC) is required.
* Working experience with Microsoft Sentinel and Microsoft Defender for Cloud, including analytics rule authoring or tuning, data connector configuration, and Defender plan rollout.
* Strong working knowledge of Microsoft Entra ID, including PIM for Groups, conditional access basics, managed identities, and certificate‐based service principal authentication.
What's on Offer
* Central Brisbane based role in a 2/3 hybrid environment
* Competitive daily rate
* 6 month initial contract with view to extend.
#J-18808-Ljbffr