Cloud Architect

About the role

Architecture

• Own the Azure architecture diagram across the platform and keep it current.
• Design changes to topology as the product grows (new container apps, replicas / autoscale rules, search-index sharding, queue strategies, multi-region considerations).
• Approve major infrastructure changes from engineering schema migrations on shared DBs, new public endpoints, new secrets in Key Vault, cross-service dependencies.
• Define and enforce naming conventions, resource tagging (cost centre, environment, owner), and resource-group structure across subscriptions.
• Networking & edge
• Manage DNS (public domains and internal Azure DNS zones).
• Own Azure Front Door profiles origins, routes, rules, custom domains, SSL / TLS.
• Manage the edge CDN provider (e.g. Cloudflare) for public surfaces DNS, page rules, caching, purge workflows, security rules.
• Azure Application Gateway where still in play.
• WAF policies rule tuning, false-positive triage, blocking abusive traffic without blocking real users.
• Plan and execute domain migrations, certificate renewals, and edge cache strategy.

DevOps & CI/CD

• Own Azure DevOps Pipelines build / test / release templates, service connections, variable groups, environment approvals, artifact retention.
• Container build optimisation (image size, layer cache, build time), ACR retention policies.
• Deployment strategies blue / green via container-app revisions, canary rollouts, rollback playbooks.
• Pipeline templates that every engineering team can reuse without copy-paste.
• Secret management Key Vault references, rotating credentials, getting secrets out of .env files.
• FinOps / cost optimisation
• Continuously audit Azure spend across all subscriptions and bring monthly cost reports to leadership.
• Identify and execute cost-cutting moves right-sizing container apps, reserving compute where stable, switching tiers, killing zombie resources, reviewing egress / CDN charges.
• Quantify cost-versus-performance trade-offs for any proposed architecture change.
• Must-have experience
• **6+ years**
• in Azure as primary cloud (not someone who learned it last year).
• Azure services mastery: Container Apps, App Services, Function Apps, ACR, AKS basics, Azure Database for PostgreSQL, Cosmos DB for PostgreSQL (Citus), Storage Blob, Service Bus, Key Vault, Application Insights, Log Analytics.
• Azure Front Door (Standard + Premium) deep configuration experience.
• Edge CDN provider (e.g. Cloudflare) at the operational level zone management, page rules, firewall rules, cache purge, API automation.
• WAF rule design and tuning (Azure FD WAF or equivalent).
• DNS at scale public, private, split-horizon, NS delegation.
• Azure DevOps Pipelines YAML templates, multi-stage pipelines, service connections (and the permission politics of who can create them).
• Networking fundamentals VNet, NSG, peering, private endpoints, service endpoints.
• Strong scripting: Bash, PowerShell, Python; comfortable with the Azure CLI.
• IaC: Bicep or Terraform (at least one in production), and ARM as a fallback when reading legacy.
• FinOps practice has actually saved money in a prior role, not just read about it.
• Nice to have
• **Azure certifications (AZ-104 / AZ-305 / AZ-400).**
• Multi-subscription tenant management with Entra ID (formerly Azure AD).
• Kubernetes (AKS) even if not currently in use.
• SRE practices SLOs, error budgets, on-call rotations.
• Observability beyond App Insights Grafana, Datadog, ELK stacks.
• Database operations background (PostgreSQL HA, replication, point-in-time restore).
• Security background (CIS benchmarks, vulnerability scanning, container scanning).