SME - Microsoft Azure - IaaS, Azure Kubernetes Service

In this role you will design, operate, and secure a multi-tenant secure access and file transfer platform. You will work closely with security and DevOps teams to ensure robust, auditable access and transfer workflows at scale. You will shape the platform by implementing tenancy isolation, credential lifecycle automation, and metering to support regulated financial services environments. This is a hands-on position that combines gateway tech, cloud-native ops, and governance to enable trusted cross-team collaboration.

• Design and operate interactive access service via Apache Guacamole on OpenShift, translating HTTPS to native protocols
• Build and maintain file transfer via S3 presigned URLs with time-bounded access and tenant-scoped controls
• Engineer tenant isolation in shared SaaS deployments with predefined connections and network controls
• Automate credential lifecycle with session-based seeding and session-stop removal, integrated with PAM and credential stores
• Implement session recording and logging pipelines to tenant log repos (Kafka, S3, Git)
• Develop CI/CD pipelines for platform lifecycle: provisioning, start, stop, decommissioning (immutable infra)
• Collaborate with security to refine detection scenarios and maintain audited control reporting (Seven IT Risk Controls, COBIT)
• Define and monitor SLIs/SLOs including latency, session success, recording completeness, tenant isolation, and credential reset compliance

• 3+ years hands-on experience with Kubernetes/OpenShift in production
• Proficiency in Go and Python for platform service development
• Strong Linux systems engineering (SSH, networking, security hardening, systemd)
• Container orchestration and CI/CD design (Helm, ArgoCD, Tekton)
• S3-compatible object storage (MinIO or AWS S3): presigned URLs, bucket policies, IAM integration
• Azure DevOps for backlog management and release workflows
• Infrastructure as Code: Terraform, Ansible
• Understanding of security principles: zero-trust, defence-in-depth, MFA, credential management
• Experience with IAM systems, directory services integration, and conditional access policies
• Familiarity with logging and monitoring stacks (Kafka, Elasticsearch, Prometheus/Grafana)

• Kubernetes/OpenShift production experience
• Go, Python
• Linux security hardening, SSH, networking
• Helm, ArgoCD, Tekton
• S3-compatible storage (MinIO/AWS S3), presigned URLs, IAM
• Terraform, Ansible