Cloud Engineering Lead (Azure) 6 month contract, scope to extend £600 - £625 P/D Inside IR35 Hybrid Active SC would be advantageous We are looking for a hands-on Cloud Engineering Lead with deep Microsoft Azure expertise to build, run and productise an enterprise Azure platform. You will turn approved architecture into policy-governed infrastructure delivered entirely through code and automated pipelines, make sure the platform is reliable and operationally ready, and treat product teams as customers, giving them a clear, low-friction route onto the platform. Key responsibilities - Platform engineering Lead design and build of Azure Landing Zones: management groups, subscription vending and hub-and-spoke networking. Own the provisioning pipelines and a reusable Terraform/Bicep module library built on Azure Verified Modules. Enforce governance as code (Azure Policy, RBAC/PIM, Defender for Cloud) and integrate ServiceNow to automate platform requests. Set engineering quality standards: code reviews, branching and release strategy, pipeline quality gates. Lead brownfield remediation of existing subscriptions and workloads onto platform standards.Reliability and operations Define platform SLOs and track service health through observability built on Azure Monitor / Log Analytics, integrated with Sentinel (Security Operations) and the NOC. Drive operational readiness and acceptance, with runbooks and documentation in place before handover to Cloud Run (BAU operations). Lead resolution of platform incidents, feed root causes into problem management, and reduce toil through automation as part of continual service improvement.Consumer experience and adoption Understand the consumer journey and operate the platform "front door": intake, onboarding and the service catalogue. Publish paved roads with clear documentation, and run onboarding clinics to drive adoption. Use feedback and friction analysis to improve the experience, including the AVD / engineering workspace experience. Apply the "rule of three": a pattern requested three or more times becomes a productisation candidate for the catalogue.Mandatory skills & experience Extensive hands-on Microsoft Azure experience (typically 7+ years in IT, 4+ on Azure) covering design, architecture and implementation of enterprise platforms. Proven delivery of Azure Landing Zones / Cloud Adoption Framework: management groups, subscription vending, hub-and-spoke, Azure Firewall, private DNS and Private Endpoints. Expert Terraform and Bicep: modular design, state management, testing and versioning; working knowledge of Azure Verified Modules. Strong Python (plus PowerShell / Azure CLI) for automation and API integration. Proven ability to build and maintain multi-stage, approval-gated provisioning pipelines (Azure DevOps and/or GitHub Actions) with Git-based workflows. Azure security and governance: Entra ID, RBAC/PIM, managed identities, Key Vault, Azure Policy, Defender for Cloud.Observability and reliability: Azure Monitor / Log Analytics, alerting, defining SLOs and service health measures. Operational readiness: runbooks, incident handling and handover into run/support teams (ITIL-aligned). Experience leading and mentoring cloud/DevOps engineers in an agile team, including code review and release practices.Desirable skills & experience Platform-as-a-product experience: paved roads / golden paths, service catalogue, developer experience and consumer feedback loops. ServiceNow integration for self-service provisioning and ITSM (incident, problem, change). Microsoft Sentinel and integration with SOC / NOC functions. SRE practices: error budgets, post-incident reviews, toil measurement. Brownfield remediation or migration of existing Azure estates. Azure Virtual Desktop (AVD) / Windows 365 workspace experience. AI and integration platform services: Azure OpenAI / AI Foundry, API Management, Service Bus, Event Grid. Policy-as-code testing and pipeline security tooling (e.g. PSRule, Checkov, tfsec). FinOps awareness (tagging, budgets, cost reporting); AKS / container platforms. Certifications: AZ-305, AZ-400, AZ-104 / AZ-700, HashiCorp Terraform Associate, ITIL 4