Azure Platform Engineer

We are seeking a full-time Azure Platform Engineer to help design automate secure and operate a large-scale enterprise Azure environment. This role is responsible for the day-to-day administration governance and evolution of a multi-subscription Azure platform supporting mission-critical workloads.

You will own real infrastructure and operations building Infrastructure as Code automation solutions CI/CD pipelines security controls and governance frameworks that keep the platform secure compliant cost-efficient and resilient. This is a hands-on engineering role with deep operational ownership where you will take solutions from architecture through production support.

This position is based in the Reston VA / Rockville MD area a hybrid work arrangement with occasional on-site collaboration.

This role supports production systems participates in a shared on-call rotation and is expected to support after-hours and weekend maintenance windows when required. The engineer must be able to plan execute and support production changes and respond to production incidents during assigned on-call periods.

• Administer enterprise Azure environments across multiple subscriptions and management groups.
• Manage Azure Landing Zones Management Groups Azure Policy role-based access control (RBAC) and subscription lifecycle processes.
• Govern Azure resources to support security compliance and operational consistency.

• Design deploy and maintain cloud infrastructure using Terraform Bicep ARM templates or similar IaC tools.
• Manage infrastructure deployments through governed CI/CD pipelines rather than manual portal-based changes.
• Develop reusable modules and templates that enforce enterprise standards.

• Build automation that reduces operational overhead and enables controlled self-service capabilities.
• Develop Azure Automation runbooks Azure Functions Logic Apps and PowerShell-based automation.
• Automate governance compliance validation resource provisioning drift detection and remediation.

• Design and maintain GitHub Actions and Azure DevOps deployment pipelines.
• Implement environment promotion strategies across development test staging and production.
• Build secure deployment workflows with validation approvals automated testing and notifications.

• Implement and maintain controls using Microsoft Defender for Cloud Microsoft Sentinel Azure Policy Azure Key Vault and Microsoft Entra ID.
• Design and enforce identity access management privileged access and least-privilege processes.
• Support security assessments vulnerability remediation and compliance initiatives.

• Design deploy and troubleshoot Virtual Networks Private Endpoints ExpressRoute VPN Gateway Azure Firewall NSGs Application Gateway and Web Application Firewall.
• Support hybrid connectivity routing DNS segmentation and secure application access patterns.

• Serve as an escalation point for complex production issues.
• Perform incident response root cause analysis and post-incident corrective actions.
• Own problems end to end across infrastructure networking identity and platform services.

• Support NIST 800-53 FedRAMP SOX and other applicable compliance initiatives.
• Maintain evidence collection control documentation and audit readiness.
• Participate in code reviews design reviews change management (CAB) and operational documentation.

Azure Platform: Azure Landing Zones Management Groups Azure Policy Azure Resource Manager Azure Monitor and Log Analytics

Identity & Security: Microsoft Entra ID Privileged Identity Management (PIM) Microsoft Defender for Cloud Microsoft Sentinel Key Vault and Conditional Access

Networking: Virtual Networks Private Endpoints Azure Firewall ExpressRoute VPN Gateway Application Gateway and Web Application Firewall

DevOps & Automation: GitHub Actions Azure DevOps Terraform Bicep ARM templates Azure Automation PowerShell and Azure CLI

Data & Platform Services: Azure Storage Azure SQL App Service Function Apps Azure Kubernetes Service Azure Databricks and Microsoft Fabric

• U.S. citizenship required by federal contracts
• Bachelors degree in Computer Science Information Technology Engineering or a related field or equivalent professional experience.
• Five or more years of hands-on Azure infrastructure or platform administration experience.

• Experience managing enterprise Azure environments across multiple subscriptions and environments.
• Strong understanding of networking systems administration cloud architecture and identity management.
• Practical experience with Infrastructure as Code using Terraform Bicep ARM templates or comparable tools.
• Experience designing or operating CI/CD pipelines using GitHub Actions or Azure DevOps.
• Proven ability to diagnose resolve document and prevent recurrence of production issues.
• Strong communication and collaboration skills in a small high-ownership team.
• Availability for a shared on-call rotation and after-hours or weekend change-window support.

• Microsoft Certified: Azure Administrator Associate (AZ-104).
• Microsoft Certified: Azure Solutions Architect Expert (AZ-305).
• Microsoft Certified: DevOps Engineer Expert (AZ-400).
• Microsoft Certified: Azure Security Engineer Associate (AZ-500).

• Demonstrated ability to use AI-assisted tools such as Microsoft Copilot or GitHub Copilot to improve engineering productivity scripting documentation troubleshooting and operational analysis while applying appropriate human review and maintaining security privacy and compliance standards.
• Experience with enterprise Azure Landing Zone implementations.
• Experience with Microsoft Defender XDR Microsoft Defender for Cloud or Microsoft Sentinel.
• Experience operating in compliance-driven environments using NIST 800-53 FedRAMP SOX or similar frameworks.
• Automation experience with PowerShell Python or C#.
• Experience supporting hybrid Azure and on-premises environments.
• Experience with Azure Databricks Microsoft Fabric Kubernetes or advanced data-platform services.

• Own and influence an enterprise-scale Azure platform with meaningful operational responsibility.
• Work across Azure governance platform engineering security automation reliability and cloud transformation.
• Build modern cloud operating models using Infrastructure as Code and DevSecOps practices.
• Join a small highly skilled team where engineers have direct impact on architecture and operational decisions.
• Work in a flexible hybrid environment with opportunities to grow into senior engineering and cloud architecture leadership roles.

Working at ICF

We can only solve the worlds toughest challenges by building a workplace that allows everyone to thrive. We are an equal opportunity our employees are empowered to share theirexpertiseand collaborate with others to achieve personal and professional goals. For more information please read ourEEOpolicy.

We will consider for employment qualified applicants with arrest and conviction records.

Work Authorization and Sponsorship

All candidates must be authorized to work in the United States. This position is not eligible for new H-1B visa sponsorship by ICF. Candidates who currently hold valid work authorization may be considered for a change of employer petition subject to company policy and applicable immigration requirements.

Reasonable Accommodations

Reasonable Accommodations are available including but not limited to for disabled veterans individuals with disabilities and individuals withsincerely heldreligious beliefs in all phases of the application and employment process. To requestan accommodationplease emailand we will be happy toassist. All information you provide will be kept confidential and will be used only to the extentrequiredto provide needed reasonable accommodations.

Read more aboutworkplacediscriminationrightsor our benefit offerings which are included in theTransparency in (Benefits) CoverageAct.

Bot and Third-Party Applications

Please note that this application must be submitted directly by the applicant for consideration.Failure to do so may result in the application being excluded for consideration.Applicants needing an accommodation for disability or religious purposes in connection with the application process should contactfor assistance.

Candidate AI Usage Policy

At ICF we are committed to ensuring a fair interview process for all candidates based on their own skills and knowledge. As part of this commitment the use of artificial intelligence (AI) tools to generate orassistwith responses during interviews (whether in-person or virtual) is notpermitted. This policy is in place tomaintainthe integrity and authenticity of the interview process.

However we understand that some candidates may require accommodationthat involves the use of AI. Ifsuch anaccommodation is needed candidates are instructed to contact us in advance at. Weare dedicated to providingthe necessary support to ensure that all candidates have an equal opportunity to succeed.

Pay Range

There are multiple factors that are considered in determining final pay for a position including but not limited to relevant work experience skills certifications and competencies that align to the specified role geographic location education and certifications as well as contract provisions regarding labor categories that are specific to the position.

The pay range for this position based on full-time employment is: