Azure AI Application Platform & DevSecOps Engineer
osborn hollowayBaltimore (MD)
Azure AI Application Platform & DevSecOps Engineer
Posted 3 days ago
osborn hollowayBaltimore (MD)
SENIORITY
Lead
About the role
Azure AI Application Platform & DevSecOps Engineer Senior Individual Contributor | Azure | Full Stack | Platform Engineering | DevSecOps | ALM | Fully Remote Contract Position | C2C | 1099 | 70-85 USD/hrPosition Summary Osborn & Holloway is seeking a senior Azure Application Platform & DevSecOps Engineer to help design and build a governed internal AI application incubation platform that allows non-technical and semi-technical business users to create custom web applications safely within the Microsoft Azure ecosystem. The user experience should be deceptively simple. A business user may know what application they want to build without knowing how to create an Azure Resource Group, register an application, configure an identity, provision a Key Vault, select a hosting model, create a deployment pipeline, secure a database, configure monitoring, or manage environment promotion. This role is responsible for helping turn RedSail’s architectural, security, infrastructure, and SDLC expectations into automated platform behavior and enforceable guardrails. We are not trying to eliminate SDLC. We are trying to encode SDLC into the platform so the business user does not have to perform it manually. This engineer will work closely with a complementary AI Application Platform Engineer responsible for the conversational, AI-assisted, and application-generation layers of the platform. Together, these engineers will build a “system that builds systems.”What Makes This Role Different This is not a traditional Azure administrator or DevOps position. The successful candidate will design the infrastructure and governance abstraction layer that allows users who know very little about Azure to safely create applications inside it. The platform—not the citizen developer—should understand how applications are provisioned, secured, monitored, promoted, governed, and eventually retired. The goal is not merely automation. The goal is to make the correct enterprise engineering path the easiest—and whenever appropriate, the only—path available.
Key Responsibilities:
- Azure Platform Engineering·
- Design the Azure architecture supporting the application incubation environment.·
- Develop approved deployment patterns for common categories of internally generated web applications.·
- Automate provisioning and configuration of Azure resources required by generated applications.·
- Establish appropriate patterns for Resource Groups, application hosting, storage, databases, APIs, identities, networking, monitoring, and supporting services.·
- Develop reusable infrastructure components using Infrastructure as Code.·
- Use Bicep, Terraform, or other approved technologies to make infrastructure provisioning repeatable and auditable.·
Establish naming, tagging, ownership, lifecycle, and cost-management standards for generated resources.
Identity, Security and Governance·
Design secure authentication and authorization patterns using Microsoft Entra ID.·
Automate appropriate use of managed identities, app registrations, service principals, and RBAC.·
Establish automated Key Vault and secrets-management patterns.·
Prevent generated applications from adopting unsafe credential, secret-storage, or access-control practices.·
Incorporate Azure Policy and other governance mechanisms into the incubation environment.·
Establish appropriate security scanning, package/dependency validation, and code-quality controls.·
Collaborate with security and infrastructure stakeholders to define boundaries within which citizen-generated applications may operate.·
Design technical controls that prevent generated applications from bypassing required governance.
DevSecOps and Application Lifecycle Management·
Design automated source-control and CI/CD patterns for generated applications.·
Integrate the platform with Azure DevOps repositories, work items, pipelines, and release processes.·
Establish standardized DEV, test/UAT, and production deployment patterns.·
Build automated quality, security, and approval gates into application promotion.·
Ensure generated applications remain traceable, supportable, and recoverable.·
Develop rollback, backup, monitoring, logging, and operational-support patterns.·
Automate creation of appropriate deployment and operational documentation.·
Establish lifecycle processes for application ownership transfer, retirement, and resource decommissioning.
Application Incubator Guardrails·
Work with the AI Application Platform Engineer to translate enterprise engineering standards into automated platform rules.·
Define which architectural decisions may safely be made automatically and which require human review.·
Establish thresholds that determine when a self-service application must “graduate” into formal architecture, security, engineering, or governance review.·
Consider factors including data sensitivity, regulatory implications, external exposure, integration complexity, transaction volume, business criticality, and user population.·
Build mechanisms that prevent an application from progressing when required controls have not been satisfied.·
Ensure the platform can explain why an application has been stopped, escalated, or routed for additional review.
Full-Stack and Integration Engineering·
Maintain sufficient full-stack development capability to understand and troubleshoot applications produced by the incubation platform.·
Develop APIs and platform services required to connect AI orchestration, application generation, Azure provisioning, and DevOps automation.·
Collaborate on reusable application components and architectural templates.·
Support integrations with approved Microsoft enterprise services and business systems.·
Participate directly in troubleshooting generated applications when failures span application, infrastructure, identity, security, or deployment boundaries.
Required Qualifications:
- Significant professional experience with Microsoft Azure architecture and engineering.· Strong understanding of Azure identity, security, networking, compute, storage, application hosting, and data services.· Hands-on experience with Microsoft Entra ID, RBAC, managed identities, app registrations, and enterprise authentication patterns.· Experience with Azure Key Vault and secure secrets-management practices.· Strong Infrastructure-as-Code experience using Bicep, Terraform, or comparable technologies.· Strong Azure DevOps experience, including repositories, pipelines, and application lifecycle management.· Practical experience designing CI/CD and DevSecOps processes.· Working full-stack development knowledge sufficient to understand modern web applications, APIs, databases, and application architecture.· Strong understanding of SDLC, environment management, testing, release management, and production-support principles.· Familiarity with Agile development methodologies.· Strong written and verbal English communication skills.· Ability to work independently while collaborating closely with another senior engineer across overlapping areas of responsibility.
Preferred Qualifications:
- Relevant Microsoft Azure certifications.· Experience with Azure OpenAI or AI-enabled application platforms.· Experience developing internal developer platforms, application factories, self-service provisioning systems, or Platform Engineering capabilities.· Experience with Azure Policy and enterprise cloud governance.· Experience with Microsoft Power Platform, Dataverse, Power Automate, or other low-code/no-code technologies.· Experience with application observability, Application Insights, Log Analytics, and automated operational monitoring.· Experience designing systems in regulated, healthcare, financial, or other security-conscious environments.· Experience with secure software supply-chain practices and automated vulnerability management.· Familiarity with FinOps and cloud cost-governance principles. The Person We Are Looking ForYou should be an engineer who believes automation is most valuable when it eliminates opportunities for people to make avoidable mistakes. You understand that hiding Azure complexity from a business user does not eliminate that complexity—it transfers responsibility for handling it correctly to the platform. You should be comfortable working in the space between software engineering, cloud architecture, security, DevOps, and platform engineering. You should also be pragmatic. Not every departmental application needs an architecture review board. Conversely, a prototype that suddenly begins storing sensitive data or supporting a critical business process cannot remain an uncontrolled experiment simply because that is how it started. The successful candidate will help us find—and automate—that boundary. Ultimately, your job is to make it possible for someone who knows almost nothing about enterprise software engineering to create useful applications without requiring the organization to accept the risks that would normally accompany that lack of knowledge.
Before you apply
Applying takes about a minute. These four things decide how fast it moves after that.
Your profile is current
It's what we read first. Occupations, seniority and locations matter more than a long history.
Two examples you can talk through
Not a portfolio — just two pieces of work where you can explain the decisions and what you'd change.
A number in mind
What you're on now and what would make you move. We negotiate better when we know both.
Your notice period
Employers plan around it, and it's the question that stalls offers most often.
Once you apply, someone reads it and calls you before anything reaches the employer — usually within two working days.