Azure Landing Zone Architect (Advisory): Healthcare SaaS, Terraform, Multi-Region

The role We run a GP-led telehealth platform operating across the UK, Australia and New Zealand. We're moving off Fly.io and Supabase onto Azure, and we need an experienced platform architect to design the target landing zone and review our build. Our in-house team writes the code. You set the standard, review the work, and keep us out of trouble. The core constraint: a standardised, country-based stack where each country's patient data sits in its own isolated environment, defined in Terraform so we can stand up a new region quickly and consistently. We're in an NHS contract, so evidence of where data lives and who can access it matters. What you'll do (design and review, not hands-on build) Design the Azure landing zone: management group and subscription structure, regions, Azure Policy, networking, identity. Define the Terraform standard: module structure, per-region environment isolation, remote state security, approval gates, secret handling. Set identity patterns: Entra RBAC, PIM, MFA, break-glass, service principals and managed identities. Set network patterns: private endpoints, ingress and egress, WAF, Front Door, firewall, logging. Set secrets handling: Key Vault, no secrets in code or CI, rotation, managed identity by default. Set observability: app and audit logging, immutable export, Sentinel and Defender alerting. Review CI/CD security: SAST, dependency scanning, IaC scanning, container scanning, branch protection. Own the migration and cutover plan: data migration, rollback, backup, validation. Review our Terraform, pipelines and architecture on a regular cadence and flag what needs to change. We run an AI-assisted engineering workflow. Our coding agents load self-contained instruction files ("skills") that encode our engineering standards, backed by deterministic controls: Terraform modules, policy-as-code, CI/CD checks and human approval for production. You'd help shape and review those so the written guidance, the code and the automated gates line up. Comfort reviewing AI-generated IaC is important. Must-haves Proven Azure landing zone design at enterprise scale (Cloud Adoption Framework / enterprise-scale). Strong Terraform: reusable modules, multi-environment and multi-region isolation, remote state security, approval workflows. Azure identity depth: Entra ID, RBAC, PIM, managed identities, service principals. Azure networking depth: private endpoints, Front Door, WAF, Azure Firewall, hub-and-spoke. Key Vault and secrets management. Observability with Log Analytics, Sentinel and Defender for Cloud. CI/CD pipeline security, including IaC and container scanning and branch protection. Data migration and cutover planning. Nice-to-haves Healthcare or other regulated-data experience. Multi-region data residency and sovereignty patterns. Policy-as-code (Azure Policy, OPA / Conftest). Comfort working alongside AI coding agents. Engagement Part-time, ongoing, hourly. Remote. Heavier in the near term while we lock the architecture and migrate (we expect a 2 to 3 week build window once the design is set), then lighter ongoing assurance and review.