DevOps Engineer

CitiusTech is hiring a Bicep / Azure DevOps Engineer to automate infrastructure for a multi-wave data center migration to Microsoft Azure for a US healthcare payer. The role owns reusable Bicep modules and Azure DevOps pipelines, provisions compliant application infrastructure, and supports migrations through validation, cutover, and hypercare.

Responsibilities:

• Author, maintain, and version reusable Bicep modules in a shared module registry, covering compute, networking, load balancers, storage, Key Vault, monitoring, and backup
• Build application-specific Bicep templates from approved migration playbooks and target architecture designs
• Apply the client's naming, tagging, and Azure Policy standards in every template
• Validate templates with linting, what-if, and pipeline checks before any deployment
• Design and run Azure DevOps YAML pipelines for infrastructure deployment across non-production and production
• Implement approvals, environment gates, and service connections that align with the program's CAB and change process
• Automate repeatable build and validation steps with PowerShell, Azure CLI, or Bash to cut manual effort in each wave
• Provision landing zone placements for each application: subscriptions and resource groups, VNets and subnets, NSGs, load balancers, and private endpoints
• Support rehost migrations with Azure Migrate, including replication, test migrations, and cutover
• Support replatformed and net-new deployments, including containerized workloads on AKS
• Take part in pre-production validation, cutover execution, rollback rehearsals, and hypercare
• Keep Azure DevOps Boards current and produce the build evidence needed for each approval gate
• Build security controls into templates: Bastion-only administration, private access, encryption, diagnostic settings, and log forwarding to Microsoft Sentinel
• Work with the Security team on privileged access (CyberArk), endpoint protection onboarding, and firewall rule requests
• Make sure every deployment meets the program's security and logging baseline and its HIPAA and HITRUST requirements
• Work closely with the Lead Cloud Migration Engineer, Cloud Architect, network and security leads, and client platform teams
• Contribute to playbooks, runbooks, and lessons learned after each wave

Requirements:

• 10+ years in DevOps or cloud engineering, including 3+ years on Microsoft Azure
• Bicep in production: modules and module registries, parameter files, loops and conditions, outputs, deployment scopes (resource group, subscription, management group), and what-if deployments
• Azure infrastructure: VNets, subnets, NSGs, route tables, load balancers, VMs and availability zones, storage, Key Vault, Azure Monitor, and Log Analytics
• Azure DevOps: YAML pipelines, environments and approvals, service connections, Repos, and Boards
• Landing zones: hub-and-spoke networking, Azure Policy, RBAC, and management group design
• PowerShell and Azure CLI
• Git: branching, pull requests, and code review
• Migration delivery: moving on-premises workloads to Azure
• Bash is a plus
• ideally with Azure Migrate
• ARM templates, or Terraform with experience converting it to Bicep
• Azure Firewall, Azure Bastion, private endpoints, and private DNS zones
• Microsoft Sentinel, Defender for Cloud, and diagnostic settings at scale
• Azure Kubernetes Service deployments
• Regulated environments, especially healthcare (HIPAA, HITRUST)
• CyberArk, F5, or Palo Alto in hybrid environments
• Change control (CAB) and gated delivery
• Azure Administrator Associate (AZ-104)
• DevOps Engineer Expert (AZ-400)
• Azure Solutions Architect Expert (AZ-305), a plus