# Platform Engineer (Azure) - Own the Azure platform end to end - infrastructure, deployments, environments, identity and security. - Build infrastructure as code, verify what you deploy, and make reliable environments routine. - Take real ownership of the platform that supports Fusion5’s product engineering team. **About the role** We are looking for an Azure specialist to own our cloud platform end to end: the infrastructure, the deployment path, the environments, and the identity and security that sit around them. This is a hands-on engineering role rather than an advisory one. We want someone who defines infrastructure in code, verifies what they deploy, and wants complete ownership of the platform rather than shared responsibility for parts of it. You will take over infrastructure, deployment and environment work that currently sits with our engineering lead, and you will be the person the team relies on to get an environment stood up properly and quickly. **What you'll do** **The Azure estate** Own our infrastructure as code: Azure Container Apps, Azure Database for PostgreSQL Flexible Server with Entra-only authentication, Key Vault, Azure Front Door with WAF, virtual networks, private endpoints and private DNS, and managed identity throughout. Keep the running estate aligned to the secure reference architecture as the product changes, rather than letting the two drift apart. Own sizing, capacity and cost. **Deployment and CI/CD** - Own the deployment path end to end through the Azure Developer CLI, from environment configuration through Bicep parameters to the settings the running application actually sees. - Verify deployments by reading state back out of Azure. A command that exits cleanly is not evidence that a setting applied. - Own build and release pipelines in Azure DevOps, including sharded test runs and Linux container images carrying native dependencies. **Environments** - Build and run the development, test and demonstration environments, and the sandbox tenants the product is tested against. - Own the credentials and consent that make those environments reachable: Entra ID app registrations, service principals, app-only consent, and certificate and secret rotation, with Key Vault as the only place secrets live. - Make standing up a fresh, working environment a routine act rather than a project. **Security and operations** - Own the security posture in practice: network isolation, least privilege, secret handling and tenant isolation. Support customer security questionnaires and security reviews with evidence rather than assertion. - Own observability: Application Insights and Log Analytics, alerting that means something, and a health view somebody would actually look at. - Write and maintain the runbooks, so that the platform does not depend on any one person. **Essential skills & expereince** - Five or more years in Azure infrastructure and platform engineering, predominantly hands-on rather than advisory. - Bicep as your primary tool. You define infrastructure in code and treat the portal as a place to look rather than a place to change things. Equivalent depth in Terraform or ARM is fine if you are ready to work in Bicep from day one. - Azure Container Apps or AKS, Azure Database for PostgreSQL Flexible Server, Key Vault, Azure Front Door, Web Application Firewall, virtual networks, private endpoints and private DNS zones. - Microsoft Entra ID in depth: app registrations, service principals, managed identity, app-only against delegated permissions, admin consent, and certificate credentials and their rotation. - Azure DevOps YAML pipelines, or GitHub Actions with a willingness to work in Azure DevOps. - Docker and Linux container builds, including images that carry native dependencies. - Azure CLI, the Azure Developer CLI (azd), and PowerShell or Bash to a good standard. - Enough TypeScript and Node to read the application, debug a configuration problem and make a small fix yourself. You will be working alongside the application, not around it. - The habit of verifying. When you say something is deployed, it is because you have checked the running state, not because a pipeline went green. **Desirable** - Microsoft certifications: AZ-305 Azure Solutions Architect Expert, AZ-400 DevOps Engineer Expert, or AZ-104 Azure Administrator. - Microsoft business platform administration: Power Platform and the pac command line, Dataverse environment management, Managed Environments, or Dynamics 365 Finance and Operations environments through LCS. - Microsoft Graph app-only access and SharePoint tenant administration. - Microsoft Fabric and Power BI workspace administration. - FinOps and Azure cost management. - A consultancy or software product background, where one platform serves several customers and isolation between them matters. - Exposure to security questionnaires, penetration test remediation, the Essential Eight or ISO 27001. **What success looks like** - 3 months - You own the deployment path, you have rebuilt an environment from code end to end, and you have told us what in the current estate you would change and why. - 6 months - Environments are stood up and proven without the engineering lead involved. Deployment is routine and evidenced. - 12 months - The platform deploys into a new subscription from code alone, the security posture is demonstrable rather than described, and the runbooks are good enough for somebody else to run it while you are on leave. **How we will access you** - A technical conversation, followed by two short practical exercises. - We will show you a Bicep template and ask what you would change and why. Then a scenario: a setting has been added to the template, the deployment reports success, and the application behaves as though the setting is absent. Talk us through how you would find out what actually happened, in the order you would do it. **About Fusion5 India** Fusion5 India is our Global Capability Centre (GCC), based in Bengaluru. It’s an integral part of the Fusion5 team - working as one with our colleagues across Australia and New Zealand to deliver managed services, applications, data and integration solutions to our customers. Operating on a follow-the-sun model aligned to AU and NZ business hours, our India team plays a central role in keeping our customers’ mission-critical platforms running. Here you’ll do meaningful, global work with direct exposure to customer architects and executives, backed by the structure, learning and career pathways of an established trans-Tasman organisation. Fusion5, we’re more than a solutions provider - we’re a Transformation Partner. Across Australia and New Zealand, we help ambitious organisations go beyond by unlocking greater value, innovation and impact from their technology investments. Across business applications, AI, cloud, data, integration and managed services, we bring together connected solutions that solve real business problems and deliver lasting value. We’re deeply committed to our customers’ success, and we bring that same energy and care to supporting our people. To apply for this role, please send your resume and cover letter to our Talent Acquisition team, recruitment@fusion5.co.nz.