Azure Networking-L3

Role Overview

We are looking for a hands-on Azure Networking professional to design implement and operate secure scalable hybrid network architectures for enterprise customers. The role covers Azure hub-and-spoke / Virtual WAN designs ExpressRoute and VPN connectivity Azure Firewall and third-party NVA integration SD-WAN and SSE integration with Azure and network automation using Terraform. The candidate will work closely with cloud security and application teams and produce customer-ready HLD/LLD runbooks and ARB-ready design artefacts.

Key Responsibilities

• Azure Network Design: Design and implement VNets subnets NSGs/ASGs UDRs peering Private Endpoints and DNS (Private DNS Zones DNS Private Resolver) aligned to Azure Landing Zone / CAF principles.
• Topology & Routing: Build hub-and-spoke and Azure Virtual WAN architectures; define routing intent forced tunnelling and inter-spoke/inter-region traffic flows; integrate NVAs with Azure Route Server using BGP.
• Hybrid Connectivity: Design and deliver ExpressRoute and S2S/P2S VPN connectivity including redundancy BGP path preference failover behaviour and bandwidth sizing.
• Network Security: Deploy and manage Azure Firewall / Firewall Policy DDoS Protection WAF and third-party firewalls (e.g. Palo Alto VM-Series); enforce segmentation and secure ingress/egress patterns.
• SD-WAN & SSE Integration: Integrate SD-WAN fabrics (e.g. Cisco Catalyst SD-WAN) and SSE platforms (e.g. Zscaler Cisco Secure Access) with Azure for branch-to-cloud and user-to-cloud access.
• Automation: Provision and change Azure network resources using Terraform and PowerShell/CLI; build reusable modules and support CI/CD-driven network changes.
• Operations & Troubleshooting: Use Network Watcher Connection Monitor flow logs and Log Analytics to troubleshoot connectivity routing asymmetry latency and DNS issues; lead RCA for P1/P2 incidents.
• Migration & Cutover: Plan and execute migrations from on-prem/legacy WAN to Azure-integrated architectures with clear validation rollback and cutover plans.
• Cost Optimisation: Recommend cost-efficient options (ExpressRoute vs VPN vWAN vs self-managed hub data transfer and firewall SKU choices).
• Documentation & Governance: Produce HLD/LLD IP plans traffic-flow diagrams runbooks and SOPs; participate in design reviews and ARB sessions.
• Stakeholder Collaboration: Work with customer architects security and application teams; mentor junior engineers on Azure networking standards.

VNet/subnet design NSG/ASG UDR VNet peering Private Endpoint/Private Link Azure DNS & Private DNS Zones DNS Private Resolver

IPv6 in Azure Azure Virtual Network Manager

Hub-and-spoke Azure Virtual WAN (secured hub routing intent) Azure Route Server

Multi-region / multi-tenant designs Landing Zone (CAF) networking

ExpressRoute (private peering Global Reach FastPath awareness) S2S/P2S VPN Gateway BGP (AS-path communities route filtering)

ExpressRoute Direct Azure Extended Network

Azure Firewall (Standard/Premium) Firewall Policy DDoS Protection WAF on App Gateway/Front Door

Palo Alto VM-Series / Fortinet NVA in Azure SSE integration (Zscaler / Cisco Secure Access)

Azure Load Balancer Application Gateway Front Door Traffic Manager

F5 BIG-IP in Azure

SD-WAN to Azure integration patterns (vWAN NVA / Cloud OnRamp / BGP peering via Route Server)

Cisco Catalyst SD-WAN Fortinet SD-WAN

Terraform Azure CLI / PowerShell ARM/Bicep basics Git-based workflows

Azure DevOps / GitHub Actions pipelines Ansible Python

Network Watcher Connection Monitor VNet Flow Logs Azure Monitor / Log Analytics ITIL Incident/Change/Problem

Traffic Analytics Sentinel basics

BGP OSPF static routing NAT ACLs IP subnetting HA (HSRP/VRRP ECMP)

MPLS VXLAN/EVPN concepts