US-based Azure SRE / DevSecOps Engineer – Azure Government

Kanda Software is seeking an Azure Site Reliability Engineer (SRE) / DevSecOps Engineer to design, operate, secure, and improve mission-critical infrastructure in Microsoft Azure and Azure Government. The role focuses on reliability engineering, observability, CI/CD, infrastructure as code, cloud networking, security and compliance, patch management, Azure Virtual Desktop, containers, Kubernetes, and technical leadership in federal and highly regulated environments.

Responsibilities:

• Observability: Build and maintain metrics, logs, traces, dashboards, and alerts
• Monitoring: Operate Azure Monitor, Log Analytics, Application Insights, Datadog, or similar tools
• Alerting: Tune alerts to reduce noise and improve actionability
• Reliability: Define and monitor SLIs, SLOs, availability, and service health
• Performance: Troubleshoot performance issues across applications and infrastructure
• Automation: Reduce operational toil through scripting and automation
• SRE Metrics: Track MTTR, availability, change failure rate, and DORA metrics
• Problem Management: Perform root-cause analysis and drive corrective actions
• CI/CD: Build and maintain Azure DevOps or GitLab CI/CD pipelines
• Deployment Automation: Automate build, test, deployment, and release processes
• Release Safety: Use approvals, validation, rollback, blue/green, and canary strategies
• Pipeline Security: Integrate SAST, DAST, vulnerability scanning, and secret detection
• IaC Security: Add IaC validation and policy-as-code to deployment pipelines
• DevSecOps: Embed security and compliance checks throughout the SDLC
• Infrastructure as Code: Provision Azure resources with Terraform, Bicep, or ARM
• Scripting: Automate operations with PowerShell, Bash/Shell, Python, or Ansible
• Reusable Infrastructure: Build standardized modules for repeatable deployments
• Environment Management: Keep development, test, staging, and production environments consistent
• Drift Management: Detect and remediate infrastructure and configuration drift
• GitOps Practices: Use pull requests, code reviews, approvals, and automated validation
• Azure Infrastructure: Operate production workloads across Azure and Azure Government
• Network Architecture: Design and maintain VNets, subnets, and hub-and-spoke architectures
• Network Security: Configure NSGs, route tables, and network segmentation
• Azure Firewall: Manage firewall policies, network rules, and application rules
• Private Connectivity: Manage Private Endpoints, Private DNS, and secure service connectivity
• Zero Trust: Apply least-privilege and controlled east-west/north-south connectivity
• Troubleshooting: Resolve Azure routing, DNS, firewall, and connectivity issues
• STIG Compliance: Maintain STIG/STIG-aligned baselines for Windows, Linux, and containers
• Compliance Automation: Automate security baseline enforcement and remediation
• Configuration Drift: Detect and correct systems that fall out of compliance
• Federal Compliance: Support FedRAMP, FISMA, CMMC, NIST, and related requirements
• Policy Enforcement: Implement controls using Azure Policy, IaC, Ansible, and scripts
• Vulnerability Management: Track and remediate vulnerabilities within required SLAs
• Audit Support: Maintain technical evidence for security and compliance assessments
• Defender for Cloud: Ensure applicable Azure workloads are onboarded and protected
• CSPM: Monitor cloud security posture and configuration risks
• Defender Coverage: Maintain protection for VMs, containers, databases, storage, and other resources
• Security Findings: Prioritize and remediate Defender recommendations and vulnerabilities
• Security Monitoring: Integrate security telemetry with Log Analytics and Microsoft Sentinel
• Security Baselines: Verify that Azure resources continuously meet required security configurations
• Patch Management: Maintain continuous patching for Windows and Linux VMs
• Azure Update Manager: Configure automated patching and maintenance schedules
• Ansible Automation: Use Ansible for patching and configuration management where appropriate
• Patch SLAs: Track patch compliance and meet remediation deadlines
• Patch Validation: Verify deployment success and handle failed or excluded systems
• Baseline Validation: Ensure patching does not break required STIG or security configurations
• AVD Operations: Operate and maintain Azure Virtual Desktop environments
• Session Hosts: Manage host pools, session hosts, and application groups
• Scaling: Configure and optimize AVD scaling plans
• AVD Images: Maintain secure and patched session-host images
• FSLogix: Manage and troubleshoot FSLogix profiles and storage
• Performance: Troubleshoot login delays, session performance, and connectivity issues
• AVD Security: Maintain Defender, access controls, and security baselines for AVD
• Containers: Deploy and operate secure Docker-based workloads
• AKS/Kubernetes: Manage Kubernetes and AKS workloads in production
• Helm: Manage repeatable Kubernetes application deployments
• Container Security: Maintain security baselines for containers and Kubernetes
• Image Security: Integrate container image scanning into CI/CD pipelines
• Release Strategies: Support rolling, blue/green, and canary deployments
• Observability: Monitor container and Kubernetes health, performance, and availability
• Cloud Architecture: Design secure, scalable, resilient, and maintainable Azure solutions
• Security Architecture: Apply Zero Trust, least privilege, and defense-in-depth principles
• Reliability Architecture: Design for high availability, scalability, and disaster recovery
• Architecture Standards: Establish reusable Azure architecture and engineering patterns
• Technical Leadership: Lead technical decisions and infrastructure improvements
• Mentoring: Guide engineers on SRE, Azure, automation, and security practices
• Cross-Team Collaboration: Partner with Engineering, DevSecOps, Security, Compliance, and Product
• Continuous Improvement: Identify risks, technical debt, and automation opportunities

Requirements:

• Strong experience in SRE, DevOps, Cloud Infrastructure, Platform Engineering, or Systems Engineering
• Hands-on experience in both DevOps and Security/DevSecOps
• Strong production experience with Microsoft Azure
• Hands-on experience with Terraform and Infrastructure as Code
• Strong PowerShell and/or Bash/Shell scripting skills
• Experience managing Azure DevOps CI/CD pipelines
• Experience with Azure Monitor, Log Analytics, Application Insights, Datadog, or similar
• Strong understanding of Azure networking, NSGs, routing, and Azure Firewall
• Experience with Microsoft Defender for Cloud and CSPM
• Experience with Windows/Linux patching and configuration management
• Hands-on experience with Docker, Kubernetes, and AKS
• Working knowledge of Microsoft Sentinel and KQL
• Experience troubleshooting complex production infrastructure and application issues
• U.S. Citizenship and authorization to work in the United States are required
• Experience with FedRAMP, FISMA, CMMC, NIST SP 800-53, and/or DISA STIGs
• Ability to translate compliance requirements into technical controls and automated enforcement
• Experience supporting federal, DoD, FedRAMP, or highly regulated environments is strongly preferred
• Hands-on experience with Microsoft Azure Government
• Experience maintaining STIG-compliant Windows and RHEL/Linux systems
• Experience with Azure Virtual Desktop and FSLogix
• Experience with Azure Update Manager and Ansible
• Experience with Azure Policy, Guest Configuration, and policy-as-code
• Experience with Microsoft Sentinel and KQL
• Experience designing Zero Trust and hub-and-spoke Azure architectures
• Experience designing and testing high availability and disaster recovery solutions
• Azure certifications such as AZ-104, AZ-500, AZ-305, or SC-100 are preferred