Our client is seeking a highly experienced Senior Windows & Cloud Infrastructure Engineer to provide expert-level technical leadership, operational support and engineering capability across Microsoft Azure, Microsoft Entra ID, on-premises Active Directory, Windows Server, DNS, enterprise networking and hybrid-cloud infrastructure.

This is a senior hands-on engineering role for an individual who can independently diagnose and resolve complex infrastructure incidents that span multiple technology layers. The successful candidate must be comfortable owning difficult production problems from initial triage through root-cause analysis, remediation and prevention.

Core requirement: deep technical expertise and advanced troubleshooting capability - not simply platform administration.

• The successful candidate must demonstrate expert-level practical capability in the core technologies below:

• Microsoft Azure

• Microsoft Entra ID

• On-premises Active Directory

• Windows Server

• DNS

• TCP/IP and enterprise networking

• Hybrid identity and hybrid cloud connectivity

• Infrastructure troubleshooting and root-cause analysis

2. Microsoft Azure - Mandatory Expert-Level Requirement

Expert-level Microsoft Azure knowledge and substantial hands-on experience are mandatory. The engineer must be able to design, implement, operate and troubleshoot Azure infrastructure independently.

• Azure Virtual Machines, VM extensions and guest/host interactions, including Azure VM Agent troubleshooting.

• Subscriptions, management groups, resource groups, Azure Policy, RBAC and governance.

• VNets, subnets, NSGs, route tables, User Defined Routes, Private Endpoints and Private DNS Zones.

• Azure DNS, VPN Gateways, ExpressRoute, Azure Load Balancer, Application Gateway and Azure Firewall.

• Azure Storage, Managed Disks, performance, resilience, networking and security.

• Azure Backup, Azure Site Recovery and disaster recovery design.

• Azure Monitor, Log Analytics, diagnostic settings, alerting and telemetry correlation.

• Azure Arc and hybrid Azure/on-premises integration where applicable.

• Cloud security, capacity planning, cost optimisation and automation.

• Advanced root-cause analysis when Azure shows infrastructure as healthy while the guest OS or application is unavailable.

3.Amazon Web Services - AWS

Expert-level AWS infrastructure knowledge and hands-on experience will be an advantage. AWS experience is not mandatory.

Candidates with strong AWS experience should be capable of independently designing, administering, troubleshooting and supporting enterprise workloads hosted in AWS. Relevant experience may include:

• Amazon EC2, VPCs, subnets, route tables, Security Groups and Network ACLs.

• Internet Gateways, NAT Gateways, VPC Peering, Transit Gateway and AWS PrivateLink.

• Elastic Load Balancing, Application Load Balancers and Network Load Balancers.

• Site-to-Site VPN, AWS Direct Connect concepts and hybrid AWS/on-premises connectivity.

• Amazon Route 53 and DNS architecture.

• IAM, IAM roles and policies, AWS Identity Center concepts and EC2 instance profiles.

• Amazon EBS, Amazon S3, AWS Backup and recovery.

• CloudWatch, CloudTrail, Systems Manager and infrastructure monitoring.

• AWS security, governance and root-cause analysis.

4.Microsoft Entra ID / Identity - Mandatory Expert-Level Requirement

Expert-level Microsoft Entra ID knowledge is mandatory. The engineer must understand identity architecture and be able to troubleshoot authentication failures across cloud and on-premises environments.

• Microsoft Entra ID tenants, users, groups and administrative roles.

• Hybrid identity, Entra Connect and Cloud Sync.

• Password Hash Synchronisation, Pass-through Authentication and federation concepts.

• Single Sign-On, Enterprise Applications, App Registrations and Service Principals.

• Managed Identities, Conditional Access, MFA and authentication methods.

• Role-Based Access Control, Privileged Identity Management and Identity Protection.

• Cross-tenant access and Microsoft 365 identity integration.

• Troubleshooting authentication, token, synchronisation and hybrid identity failures.

5. Active Directory - Mandatory Expert-Level Requirement

Expert-level Microsoft Active Directory knowledge is mandatory. Candidates must have extensive hands-on experience supporting complex enterprise domains and resolving difficult authentication and directory-service incidents.

• Active Directory Domain Services, domain controllers, forests, domains, Sites and Services, FSMO roles and Global Catalogs.

• AD replication, Kerberos, NTLM, LDAP/LDAPS and Service Principal Names (SPNs).

• Trust relationships, two-way domain trusts, SIDHistory and cross-domain authentication.

• Group Policy, delegated permissions, security groups and service accounts.

• Active Directory migrations, domain migrations and permission continuity.

• Troubleshooting replication failures, broken trusts, Kerberos/SPN failures, DC communication problems, Group Policy failures and cross-domain resource access.

• Active Directory Certificate Services experience will be advantageous.

6. DNS - Critical Mandatory Requirement

Advanced DNS knowledge is critical to this role. The candidate must understand DNS as a foundational dependency for Active Directory, Kerberos, LDAP, application connectivity and hybrid cloud services.

• Microsoft DNS and Active Directory-integrated DNS.

• Forward and reverse lookup zones, conditional forwarders, forwarders, stub zones and delegation.

• Recursive and iterative queries, caching, scavenging, dynamic registration and secure updates.

• DNS suffixes, split-brain DNS and hybrid DNS architectures.

• Azure DNS, Azure Private DNS and familiarity with AWS Route 53 where applicable.

• SRV, A, PTR, CNAME, TXT and MX records.

• Advancedtroubleshootingusingnslookup,Resolve-DnsName,dcdiag,repadmin,nltest,PowerShellandpacket-capturetools.

7.Networking - Mandatory Expert-Level Requirement

The candidate must possess expert-level infrastructure networking knowledge and be able to trace connectivity failures across operating systems, firewalls, routing and cloud networks.

• TCP/IP, IPv4, subnetting, routing, VLANs, NAT, ARP, ICMP, TCP and UDP.

• DNS, DHCP and common enterprise ports and protocols.

• Firewalls, network segmentation, routing tables, load balancing, VPNs and site-to-site connectivity.

• Azure ExpressRoute, private endpoints, NSGs and cloud routing.

• MPLS concepts, proxy/reverse-proxy infrastructure and hybrid connectivity.

• AWS networking concepts including Security Groups, NACLs, Direct Connect and Transit Gateway will be advantageous.

• Troubleshooting with Test-NetConnection, tracert, pathping, netstat, Wireshark, tcpdump, Azure Network Watcher and flow logs.

The engineer must understand that successful ICMP connectivity does not prove that an application, authentication path or required service is functioning. The expected troubleshooting path is: Application -> Operating System -> Local Firewall -> DNS -> Routing -> Network Security - > Cloud Network -> Destination Service.

8.Windows Server - Mandatory Expert-Level Requirement

Expert-level Microsoft Windows Server experience is mandatory, with strong practical experience across Windows Server 2016, 2019, 2022 and newer supported versions.

• Server deployment, administration, hardening, maintenance and lifecycle management.

• Windows services, Event Viewer, Registry, Windows Firewall and scheduled tasks.

• SMB, file servers, NTFS permissions, DFS and service accounts.

• IIS, certificate management, TLS and application-hosting dependencies.

• Performance troubleshooting across CPU, memory, disk, storage and networking.

• Windows Update, patch management and operating-system remediation.

• PowerShell and Windows Failover Clustering.

• Investigation of partially or fully unresponsive servers when the underlying cloud/hypervisor still reports the VM as running.

9.Virtualisation and Compute

Strong enterprise virtualisation experience is required. Experience should include VMware vSphere/ESXi/vCenter and/or Microsoft Hyper-V, together with Azure Virtual Machines. AWS EC2 experience will be advantageous.

• VM provisioning and lifecycle management.

• CPU and memory contention, resource allocation and performance analysis.

• Virtual networking and storage dependencies.

• Snapshots, HA, clustering and VM migration.

• Guest agents/tools, virtual drivers and hypervisor-level troubleshooting.

10. Storage

The engineer must understand enterprise storage sufficiently to distinguish operating-system, storage-platform, network and application performance problems.

• SAN, NAS, block and file storage.

• Azure Managed Disks and storage performance.

• IOPS, throughput, latency, queue depth and disk bottlenecks.

• RAID, multipathing, SMB and NFS.

• Amazon EBS and S3 experience will be advantageous.

11. Monitoring, Incident Management and Root-Cause Analysis

Advanced troubleshooting and evidence-based root-cause analysis are among the most important requirements for this position. The engineer must be able to correlate telemetry across technology layers and avoid assuming that a visible symptom is the root cause.

• Azure Monitor, Log Analytics and platform telemetry.

• Windows Event Logs, Active Directory logs and DNS logs.

• Network, firewall, storage and virtualisation telemetry.

• Application and service logs.

• Infrastructure monitoring tools such as ManageEngine OpManager, PRTG, SolarWinds or Grafana.

• AWS CloudWatch and CloudTrail experience will be advantageous.

• Management of P1 / Severity 1 incidents, technical bridges and vendor escalations.

The engineer must be able to build a defensible incident timeline and clearly separate:

1. Initiating event.

2. Contributing conditions.

3. Resulting symptoms.

4. Root cause or most probable cause.

5. Corrective action.

6. Preventative action and monitoring improvements.

12. Automation and Scripting

Strong PowerShell capability is mandatory. The engineer should actively identify opportunities to automate repetitive operational, diagnostic and remediation tasks.

• PowerShell - mandatory advanced/expert capability.

• Azure CLI, Bicep, ARM templates and Azure Automation.

• Terraform and Git-based infrastructure management.

• Azure DevOps and Logic Apps.

• Python experience is advantageous.

• AWS CLI and CloudFormation experience will be advantageous.

1. Infrastructure Security

• Least privilege, RBAC and privileged-access principles.

• Entra PIM, MFA, Conditional Access and identity governance.

• Windows Server hardening, Windows Firewall and service-account security.

• Network segmentation, firewall controls and secure hybrid connectivity.

• Certificate management, TLS and cryptographic hygiene.

• Patch management, vulnerability remediation and Microsoft Defender technologies.

• Security logging, audit evidence and change governance.

• AWS IAM and AWS security controls will be advantageous.

14. Disaster Recovery and Business Continuity

• Enterprise backup and recovery technologies.

• Azure Backup, Azure Site Recovery and VM replication.

• Veeam or equivalent enterprise backup solutions.

• Recovery testing, RPO/RTO, high availability and failover planning.

• Participation in and technical leadership of DR exercises.

• AWS Backup and AWS recovery experience will be advantageous.

15. Projects and Architecture

The Senior Windows & Cloud Infrastructure Engineer will participate in and, where appropriate, lead technical workstreams for infrastructure projects including:

• Azure migrations and cloud architecture.

• Datacentre migrations and infrastructure consolidation.

• Domain and Active Directory migrations.

• Server and operating-system upgrades.

• Hybrid cloud integration and network redesign.

• Security remediation and infrastructure hardening.

• Disaster recovery implementations.

• Infrastructure automation and monitoring improvements.

• AWS migration or architecture initiatives where applicable.

The engineer must be capable of producing technical designs, implementation plans, change and rollback plans, risk assessments, architecture diagrams, operational documentation and Root Cause Analysis reports.

16.Required Experience

• Ideally 10+ years of experience in enterprise infrastructure environments.

• Ideally 7+ years of advanced Microsoft Windows Server experience.

• Ideally 5+ years of substantial hands-on Microsoft Azure experience.

• Extensive Active Directory, Entra ID, DNS and enterprise networking experience.

• Strong experience supporting highly available, business-critical production systems.

• Experience operating hybrid cloud environments.

• Experience performing advanced infrastructure troubleshooting and root-cause analysis.

• Experience managing P1 / Severity 1 production incidents.

• Experience working within formal change-management and governance processes.

• Expert-level AWS hands-on experience will be a significant advantage, but is not mandatory.

17.Technical Competency Profile

Technology Area - Expert - Mandatory

• Microsoft Azure- Expert - Mandatory

• Microsoft Entra ID- Expert - Mandatory

• Active Directory- Expert - Mandatory

• DNS- Expert - Mandatory

• Windows Server- Expert - Mandatory

• TCP/IP & Networking- Expert - Mandatory

• Azure Networking- Expert - Mandatory

• Hybrid Cloud Infrastructure- Expert - Mandatory

• Identity & Authentication- Expert - Mandatory

• Infrastructure Troubleshooting- Expert - Mandatory

• Root-Cause Analysis- Expert - Mandatory

• PowerShell- Advanced/ Expert - Mandatory

• Virtualisation - Advanced - Required

• Infrastructure Security- Advanced - Required

• Storage- Advanced - Required

• Amazon Web Services (AWS) - Expert - Advantage

• AWS Networking - Expert - Advantage

18.Qualifications and Certifications

A relevant tertiary IT qualification is advantageous. Certifications support the application but will not substitute for demonstrated hands-on technical capability.

Preferred or relevant Microsoft certifications may include:

• Microsoft Certified: Azure Solutions Architect Expert.

• Microsoft Certified: Azure Administrator Associate.

• Microsoft Certified: Identity and Access Administrator Associate.

• Relevant Microsoft Security certifications.

AWS certifications are advantageous but are not mandatory. Examples include:

• AWS Certified Solutions Architect - Associate or Professional.

• AWS Certified SysOps Administrator.

• Other relevant AWS infrastructure, security or networking certifications.

Additional advantageous certifications may include VMware VCP, Cisco or equivalent networking certifications, and ITIL.

AWS certification is not a prerequisite for appointment. Practical capability and relevant experience will carry greater weight than certification alone.

1. Personal Attributes

• Takes ownership of complex technical problems and drives them through to resolution.

• Works independently with minimal supervision.

• Remains calm and structured during critical production incidents.

• Troubleshoots methodically and uses evidence rather than assumptions.

• Challenges weak technical conclusions and validates root-cause claims.

• Communicates complex technical issues clearly to technical and non-technical stakeholders.

• Works effectively with development, network, security, DBA and vendor teams.

• Mentors less experienced engineers and improves team capability.

• Produces clear, high-quality technical documentation.

• Is comfortable engaging Microsoft and other vendors at senior technical level.

• Participatesinafter-hoursmaintenanceandstandbysupportwhererequired.

20. Candidate Profile and Expected Troubleshooting Capability

We are specifically looking for an engineer who can be presented with a scenario such as:

The candidate must be able to independently investigate the problem across the full dependency chain:

Application -> Windows -> Identity -> Active Directory / Entra ID -> DNS -> Network -> Firewall -> Storage -> Hypervisor -> Azure / Cloud Platform

The engineer must establish the most probable cause based on technical evidence and be able to explain what evidence supports the conclusion, what evidence contradicts it and what evidence is still missing.

21. Position Summary

This is not a traditional Windows Administrator or entry-level cloud engineering role. The company requires a senior infrastructure subject matter expert with deep hands-on knowledge of Microsoft Azure, Microsoft Entra ID, Active Directory, DNS, networking, Windows Server and hybrid infrastructure.

The successful candidate must be equally comfortable designing cloud infrastructure, diagnosing a complex Active Directory or DNS failure, analysing routing and packet flow, troubleshooting an unresponsive Windows server, resolving hybrid identity issues, leading a P1 incident and producing a defensible root-cause analysis.

Expert-level AWS experience will strengthen a candidate significantly and will be considered an advantage, but AWS experience and AWS certifications are not mandatory requirements for the role.