Lead DevOps Engineer

Sphera is a leading global provider of enterprise software and services that enables companies to manage and optimize their environmental, health, safety and sustainability. Our mission is to create a safer, more sustainable and productive world.

Sphera is a portfolio company of Blackstone, a U.S.-based alternative asset investment company that focuses on private equity, technology and innovation, and more. Blackstone businesses succeed through strong partnerships, a personalized approach and a commitment to exceptional performance with uncompromising integrity. Sphera and Blackstone are leaders in the Environmental, Social and Governance (ESG) space.

We are guided by our core values of Customer Centricity, Accountability, Bias to Action, Innovation, and Collaboration. These values help us recruit the right talent to join our rapidly expanding team of around the globe. It is important to us that each and every Spherion is not only eager to challenge themselves and knows how to get work done but is an awesome addition to our company culture.

ABOUT THE ROLE

You'll be part of a global team supporting multiple SaaS environments that help make the world a safer place.

This is a senior technical leadership role on the DevOps team, working closely with the Director of DevOps. Your home base is Platform Engineering, but your remit covers every product family that consumes platform services.

Your influence here comes primarily from technical credibility, so the bar is high on both the technical and interpersonal side. You enforce the DevOps architecture and standards other teams build against, provide guidance to other leads and senior engineers on the DevOps team, and are the person engineering and product leaders come to when a design decision has real consequences.

We are Azure-first and PaaS-first, with everything defined in Terraform. We do not run Kubernetes. Our compute is Azure App Service, Function Apps, and Container Apps. This is a hands-on role. You will still be in the code, in the pipelines, and in incidents, and we expect you to stay there.

LEADERSHIP AND TECHNICAL DIRECTION

• Represent DevOps in architecture and planning forums, and surface risks and tradeoffs early rather than late.

• Define and enforce DevOps architecture and standards across the organization: reference architectures, Terraform module standards, tagging conventions, environment topology, and the review path for significant infrastructure designs.

• Provide technical guidance and mentorship to other leads and senior engineers on the DevOps team. Raise the ceiling of the team rather than absorbing the hardest work yourself.

• Partner with engineering and product leadership as a trusted advisor. Review their designs, challenge assumptions constructively, and translate infrastructure constraints into language product stakeholders can act on.

• Drive consensus across teams with competing priorities. Make the call when consensus is not reachable, document the reasoning, and own the outcome.

• Identify capability gaps on the team and in the platform, then build the case and the plan to close them.

• Support hiring through technical interviews and help define what good looks like at each level on the team.

RELIABILITY AND OPERATIONS OWNERSHIP

• Own reliability outcomes for platform services. Define and maintain SLOs, error budgets, and business-focused KPIs, and use them to drive investment decisions rather than as reporting theater.

• Own the health of the DevOps on-call rotation. Balance load, tune alerting with the NOC team to reduce noise, and keep on-call sustainable rather than concentrated on a few people.

• Partner with the NOC team as the senior technical escalation point for major platform incidents. Drive resolution across DevOps, engineering, and product, manage stakeholder communication, and keep the response organized under pressure.

• Own postmortem discipline: blameless reviews, real root-cause analysis, and follow-through so action items actually close.

• Improve mean time to detection and recovery through better observability, runbooks, and automated remediation.

COST AND CAPACITY PARTNERSHIP

• Work with our FinOps team and engineering to set cost optimization targets, and own the technical execution against them.

• Drive the engineering side of optimization: right-sizing, reservation and savings plan input, tagging discipline, and eliminating idle and orphaned resources.

• Lead capacity planning across environments and regions, and make sure growth and acquisition plans are reflected in infrastructure planning ahead of time.

• Give FinOps and engineering the cost visibility they need by keeping tagging, environment topology, and resource ownership clean and reportable.

PLATFORM ENGINEERING AND HANDS-ON DELIVERY

• Design, build, and maintain the shared Azure platform services used across all product families, covering new projects and features as well as enhancements to existing services.

• Own platform infrastructure as code in Terraform: author reusable modules, manage state, review plans, and drive changes safely through environments.

• Onboard teams onto platform services and document self-service patterns so they can move without waiting on DevOps.

• Build and maintain CI/CD pipelines in Azure DevOps for infrastructure, application deployments, and Databricks assets.

• Manage the edge: Application Gateway and WAF configuration, including rewrite rules, path-based routing, listeners, backend pools, custom rules, and TLS, as well as Traffic Manager profiles for multi-region routing and failover.

• Manage identity and access for the platform, including Entra ID app registrations, OAuth 2.0 and OIDC flows, service principals and managed identities, and RBAC role design and assignment.

• Configure and maintain Azure AD B2C, including custom SSO XML policies (Identity Experience Framework), and support product teams integrating with them.

• Operate API Management, covering API and product configuration, policy authoring, versioning, and deployment of APIM changes through Terraform and pipelines.

• Operate Azure Service Bus, including namespaces, queues, topics, subscriptions, filters, and shared access policies and permissions, all deployed and updated as code.

• Automate security, compliance, and resource-usage controls across every deployment path.

MLOPS AND AI PLATFORM SUPPORT

A distinct part of this role is enabling our MLOps team. You will be their platform-side partner and architectural advisor for:

• Deploying and configuring Azure AI Foundry projects, model deployments, and endpoints via Terraform and pipelines.

• Databricks workspace deployment and configuration, including Unity Catalog, clusters, access control, and secret scopes.

• Databricks job and workflow deployment pipelines, and promotion of notebooks, jobs, and DLT pipelines across environments.

• Implementing and enforcing AI guardrails and content-safety controls, plus the networking, private endpoints, and identity plumbing that keep model traffic and data private.

• Building repeatable, auditable deployment pipelines for models and AI services so the MLOps team can ship without manual steps.

• Setting the reference architecture and cost model for AI and data workloads before they scale.

REQUIRED SKILLS AND EXPERIENCE

Experience and Education

• 8+ years in DevOps, cloud infrastructure, or platform engineering, including 3+ years as a technical lead, staff engineer, or mentor to senior engineers.

• Demonstrated ownership of cloud architecture decisions at organization scale, not just at project scale.

• Track record of influencing teams you do not manage, and of raising the technical level of the engineers around you.

• Bachelor's degree in Computer Science or a similar field, or equivalent practical experience.

Leadership and Communication

• Excellent communication skills, with the ability to move between a deep technical review with an engineer and a clear risk summary for an executive.

• Strong mentoring and coaching instincts. You give direct, useful feedback and you develop people rather than gatekeeping knowledge.

• Sound judgment under pressure and calm ownership during incidents and escalations.

• Ability to build trust across DevOps, engineering, product, and security, and to hold a standard without becoming a bottleneck.

• Strong planning skills, and the discipline to sequence work so business expectations are met and projects land on time.

Azure Platform

• Compute (PaaS and serverless): Deep hands-on experience with Azure Web Apps and App Service, Azure Function Apps, and Azure Container Apps, including deployment slots, scaling rules, VNet integration, and configuration management.

• Networking and edge: Application Gateway and WAF, including rewrite rules, path-based routing, listeners, backend pools, health probes, custom WAF rules and exclusions, and TLS and certificate management.

• Traffic Manager profiles and routing methods.

• Cloud networking: VNets, subnets, NSGs, route tables, hub-and-spoke architecture, Private Endpoints, and Private DNS.

• Messaging and integration: Azure Service Bus, including namespaces, queues, topics, subscriptions, subscription filters and rules, and shared access policies and permissions.

• API Management: APIM configuration and policy authoring (inbound, outbound, backend, and on-error), products and subscriptions, named values, versioning and revisions, and managing APIM changes through code and pipelines rather than the portal.

• Identity and access: Entra ID app registrations, API permissions and consent, service principals and managed identities, OAuth 2.0 and OIDC flows, token and claims configuration, and Azure RBAC design and assignment.

• B2C and SSO: Azure AD B2C user flows and custom policies, including hands-on work with SSO XML policy files (Identity Experience Framework), and SAML and OIDC federation with external identity providers.

• Supporting services: Storage Accounts, Key Vault, Azure Cache for Redis, Azure Monitor, Log Analytics, and Application Insights.

Infrastructure and Code Automation

• Terraform (full working command, not just familiarity): authoring reusable modules, managing remote state and workspaces, provider and version pinning, plan and apply review discipline, import and drift remediation, and using Terraform as the single path for all resource changes, including APIM configuration and policy as well as Service Bus topology and access policies. You will own the standards other engineers write modules against.

• Strong CI/CD experience with Azure DevOps, covering YAML pipelines (and comfort with classic pipelines), multi-stage deployments, environments, approvals, service connections, and variable and secret management.

• Strong scripting skills in PowerShell and/or Bash, and fluency with Azure CLI.

• Solid Git and source-control practice, including branching strategy, pull requests, and code review at scale.

• Strong understanding of security principles, including least privilege, secrets management, network isolation, certificate lifecycle, and compliance-driven controls.

• Working knowledge of databases, both SQL and NoSQL.

PREFERRED EXPERIENCE

• Experience setting technical direction across multiple teams or product lines in a multi-tenant SaaS environment.

• Hands-on Azure AI Foundry, Azure OpenAI, or comparable managed AI platform deployment experience.

• Databricks administration and deployment automation using Unity Catalog, Databricks Asset Bundles, or the Databricks Terraform provider.

• Experience supporting MLOps or data engineering teams, including model deployment, guardrails, and content safety.

• Experience integrating infrastructure from acquisitions into an existing platform.

• FinOps practice or formal cloud cost management experience.

• Authoring or heavily customizing B2C custom policy XML from scratch.

• Containers and Docker for microservice or service-oriented architectures. Note: we do not use Kubernetes, and Kubernetes experience is not required for this role.

• Monitoring and security tooling such as New Relic, Rapid7, Azure Monitor workbooks, or similar.

• Relevant Azure certifications (AZ-104, AZ-400, AZ-500, AZ-305, or similar).

• Familiarity with C#, Java, Python, or JavaScript and React, enough to read application code and debug deployment and configuration issues alongside product teams.

Sphera is proud to be an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all colleagues.

This job description is intended to convey information essential to understanding the scope of the job and the general nature and level of work performed by job holders within this job. This job description is not intended to be an exhaustive list of qualifications, skills, efforts, duties, responsibilities or working conditions associated with the position.