We are seeking a full-time Azure Platform Engineer to help design, automate, secure, and operate a large-scale enterprise Azure environment. This role is responsible for the day-to-day administration, governance, and evolution of a multi-subscription Azure platform supporting mission-critical workloads.

You will own real infrastructure and operations, building Infrastructure as Code, automation solutions, CI/CD pipelines, security controls, and governance frameworks that keep the platform secure, compliant, cost-efficient, and resilient. This is a hands-on engineering role with deep operational ownership where you will take solutions from architecture through production support.

This position is based in the Reston, VA / Rockville, MD area, a hybrid work arrangement with occasional on-site collaboration.

Work Schedule & Availability

This role supports production systems, participates in a shared on-call rotation, and is expected to support after-hours and weekend maintenance windows when required. The engineer must be able to plan, execute, and support production changes and respond to production incidents during assigned on-call periods.

What You'll Do

Azure Platform Administration & Operations

• Administer enterprise Azure environments across multiple subscriptions and management groups.
• Manage Azure Landing Zones, Management Groups, Azure Policy, role-based access control (RBAC), and subscription lifecycle processes.
• Govern Azure resources to support security, compliance, and operational consistency.

Infrastructure as Code (IaC)

• Design, deploy, and maintain cloud infrastructure using Terraform, Bicep, ARM templates, or similar IaC tools.
• Manage infrastructure deployments through governed CI/CD pipelines rather than manual portal-based changes.
• Develop reusable modules and templates that enforce enterprise standards.

Automation & Platform Engineering

• Build automation that reduces operational overhead and enables controlled self-service capabilities.
• Develop Azure Automation runbooks, Azure Functions, Logic Apps, and PowerShell-based automation.
• Automate governance, compliance validation, resource provisioning, drift detection, and remediation.

DevOps & CI/CD

• Design and maintain GitHub Actions and Azure DevOps deployment pipelines.
• Implement environment promotion strategies across development, test, staging, and production.
• Build secure deployment workflows with validation, approvals, automated testing, and notifications.

Azure Security & Governance

• Implement and maintain controls using Microsoft Defender for Cloud, Microsoft Sentinel, Azure Policy, Azure Key Vault, and Microsoft Entra ID.
• Design and enforce identity, access management, privileged access, and least-privilege processes.
• Support security assessments, vulnerability remediation, and compliance initiatives.

Networking & Connectivity

• Design, deploy, and troubleshoot Virtual Networks, Private Endpoints, ExpressRoute, VPN Gateway, Azure Firewall, NSGs, Application Gateway, and Web Application Firewall.
• Support hybrid connectivity, routing, DNS, segmentation, and secure application access patterns.

Operational Ownership & Incident Response

• Serve as an escalation point for complex production issues.
• Perform incident response, root cause analysis, and post-incident corrective actions.
• Own problems end to end across infrastructure, networking, identity, and platform services.

Compliance & Audit Readiness

• Support NIST 800-53, FedRAMP, SOX, and other applicable compliance initiatives.
• Maintain evidence collection, control documentation, and audit readiness.
• Participate in code reviews, design reviews, change management (CAB), and operational documentation.

Azure Technologies You'll Work With

Azure Platform: Azure Landing Zones, Management Groups, Azure Policy, Azure Resource Manager, Azure Monitor, and Log Analytics

Identity & Security: Microsoft Entra ID, Privileged Identity Management (PIM), Microsoft Defender for Cloud, Microsoft Sentinel, Key Vault, and Conditional Access

Networking: Virtual Networks, Private Endpoints, Azure Firewall, ExpressRoute, VPN Gateway, Application Gateway, and Web Application Firewall

DevOps & Automation: GitHub Actions, Azure DevOps, Terraform, Bicep, ARM templates, Azure Automation, PowerShell, and Azure CLI

Data & Platform Services: Azure Storage, Azure SQL, App Service, Function Apps, Azure Kubernetes Service, Azure Databricks, and Microsoft Fabric

Essential Qualifications

• U.S. citizenship required by federal contracts
• Bachelor's degree in Computer Science, Information Technology, Engineering, or a related field, or equivalent professional experience.
• Five or more years of hands-on Azure infrastructure or platform administration experience.

Additional Qualifications

• Experience managing enterprise Azure environments across multiple subscriptions and environments.
• Strong understanding of networking, systems administration, cloud architecture, and identity management.
• Practical experience with Infrastructure as Code using Terraform, Bicep, ARM templates, or comparable tools.
• Experience designing or operating CI/CD pipelines using GitHub Actions or Azure DevOps.
• Proven ability to diagnose, resolve, document, and prevent recurrence of production issues.
• Strong communication and collaboration skills in a small, high-ownership team.
• Availability for a shared on-call rotation and after-hours or weekend change-window support.

Preferred Qualifications

• Microsoft Certified: Azure Administrator Associate (AZ-104).
• Microsoft Certified: Azure Solutions Architect Expert (AZ-305).
• Microsoft Certified: DevOps Engineer Expert (AZ-400).
• Microsoft Certified: Azure Security Engineer Associate (AZ-500).

• Demonstrated ability to use AI-assisted tools, such as Microsoft Copilot or GitHub Copilot, to improve engineering productivity, scripting, documentation, troubleshooting, and operational analysis, while applying appropriate human review and maintaining security, privacy, and compliance standards.
• Experience with enterprise Azure Landing Zone implementations.
• Experience with Microsoft Defender XDR, Microsoft Defender for Cloud, or Microsoft Sentinel.
• Experience operating in compliance-driven environments using NIST 800-53, FedRAMP, SOX, or similar frameworks.
• Automation experience with PowerShell, Python, or C#.
• Experience supporting hybrid Azure and on-premises environments.
• Experience with Azure Databricks, Microsoft Fabric, Kubernetes, or advanced data-platform services.

Why Join Us?

• Own and influence an enterprise-scale Azure platform with meaningful operational responsibility.
• Work across Azure governance, platform engineering, security, automation, reliability, and cloud transformation.
• Build modern cloud operating models using Infrastructure as Code and DevSecOps practices.
• Join a small, highly skilled team where engineers have direct impact on architecture and operational decisions.
• Work in a flexible hybrid environment with opportunities to grow into senior engineering and cloud architecture leadership roles.

Working at ICF

We can only solve the world's toughest challenges by building a workplace that allows everyone to thrive. We are an equal opportunity employer. Together, our employees are empowered to share their expertise and collaborate with others to achieve personal and professional goals. For more information, please read our EEO policy.

We will consider for employment qualified applicants with arrest and conviction records.

Work Authorization and Sponsorship

All candidates must be authorized to work in the United States. This position is not eligible for new H-1B visa sponsorship by ICF. Candidates who currently hold valid work authorization may be considered for a change of employer petition, subject to company policy and applicable immigration requirements.

Reasonable Accommodations

Reasonable Accommodations are available, including, but not limited to, for disabled veterans, individuals with disabilities, and individuals with sincerely held religious beliefs, in all phases of the application and employment process. To request an accommodation, please email Candidateaccommodation@icf.com and we will be happy to assist. All information you provide will be kept confidential and will be used only to the extent required to provide needed reasonable accommodations.  

Read more about workplace discrimination rights or our benefit offerings which are included in the Transparency in (Benefits) Coverage Act. 

Bot and Third-Party Applications

Please note that this application must be submitted directly by the applicant for consideration. Failure to do so may result in the application being excluded for consideration.  Applicants needing an accommodation for disability or religious purposes in connection with the application process should contact Candidateaccommodation@icf.com for assistance.

Candidate AI Usage Policy

At ICF, we are committed to ensuring a fair interview process for all candidates based on their own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) tools to generate or assist with responses during interviews (whether in-person or virtual) is not permitted. This policy is in place to maintain the integrity and authenticity of the interview process.  

However, we understand that some candidates may require accommodation that involves the use of AI. If such an accommodation is needed, candidates are instructed to contact us in advance at candidateaccommodation@icf.com. We are dedicated to providing the necessary support to ensure that all candidates have an equal opportunity to succeed.  

Pay Range

There are multiple factors that are considered in determining final pay for a position, including, but not limited to, relevant work experience, skills, certifications and competencies that align to the specified role, geographic location, education and certifications as well as contract provisions regarding labor categories that are specific to the position.

The pay range for this position based on full-time employment is: