Senior Azure Architect

Position Summary As a Senior Azure Architect, you will lead the design of DataSpring’s Azure platform: the landing zones, networking, identity, resilience, and governance that our healthcare data products run on. DataSpring runs several production platforms in Azure that handle protected health information for health plans and providers nationwide, and we are bringing more of their design and operation in-house from vendors. You will help shape our Azure standards, review vendor designs against them, and stay hands-on enough to prove a design before it is adopted. The ideal candidate has designed enterprise Azure environments end to end in a regulated industry, knows where Azure designs break under real load and real outages, and uses AI tools such as Claude Code to work faster.

This is a **full-time, remote, exempt position** and reports to the Director, Enterprise Architecture & Infrastructure.

Specific Responsibilities

• Lead architecture design for Azure platforms and initiatives, and contribute to the target-state architecture set by the Director, including landing zones, management group and subscription design, hub-and-spoke networking, and shared services such as API Management, messaging, and identity.
• Design for resilience: recommend availability, recovery time, and recovery point targets for each platform, and design and regularly test multi-region and disaster recovery patterns that meet them at a reasonable cost.
• Develop and apply Azure standards through Azure Policy, reference architectures, and reusable infrastructure-as-code modules (Terraform; Helm for Kubernetes workloads; Bicep a plus).
• Review designs from implementation vendors and partner teams on assigned projects before build, recommend approval, and hold them to the agreed standards through delivery.
• Lead network architecture, including private, edge, and global traffic management across regions. Responsible for maintaining DNS, hybrid connectivity, and zero-trust network security and segmentation across projects and environments.
• Partner with Information Security to meet HIPAA, SOC 2, and HITRUST requirements, with strong controls for PHI, identity and access (Microsoft Entra ID, managed identities, privileged access), encryption, and logging.
• Manage cloud costs for assigned projects within approved budgets (FinOps): tagging and showback, right-sizing, reservations and savings plans, and architecture choices that lower run cost.
• Design the platform foundations for AI workloads, including Azure OpenAI and AI Foundry capacity, gateways, and secure access patterns.
• Implement and improve observability practices (LGTM, OpenTelemetry, Azure Monitor, Log Analytics, Application Insights) so incidents can be detected, diagnosed, and traced to root cause.
• Serve as an escalation point for complex Azure incidents and lead the design fixes that follow.
• Mentor engineers on the Architecture and Infrastructure team and raise the team’s Azure design skills.
• Document architecture decisions and maintain current-state and target-state diagrams.
• Report weekly status on architecture initiatives to designated DataSpring management.
• Follow all DataSpring Policies and Procedures.

Skills

• Deep, hands-on expertise in Azure architecture: landing zones, management groups and subscriptions, Azure Policy, and the Cloud Adoption and Well-Architected Frameworks.
• Strong Azure networking: hub-and-spoke and Virtual WAN, Private Link, Azure DNS, Application Gateway and Front Door, Azure Firewall, and hybrid connectivity.
• Proven design of multi-region, highly available, and disaster recovery architectures for PaaS and container workloads (App Service, AKS, Azure SQL, Cosmos DB, Storage).
• Identity architecture with Microsoft Entra ID across multiple tenants, including managed identities, RBAC, Conditional Access, and privileged access.
• Infrastructure as code (Terraform required; Bicep a plus) and CI/CD for infrastructure; able to write and review modules, not just specify them.
• Cloud security in a regulated environment (HIPAA, SOC 2, HITRUST): encryption, key management, logging, and defense in depth.
• FinOps practice: reading Azure cost data, forecasting spend, and designing for cost.
• Ability to explain design trade-offs clearly to engineers, vendors, and executives, and to push back on a vendor design with evidence.
• Demonstrated use of AI coding assistants (e.g., Claude Code, Cursor) to accelerate design…