Senior DevOps Engineer

About the job Senior DevOps Engineer

Role: Senior DevOps Engineer
Job Ref Id: JD-1269
Competence level: Senior or expert
Start date: 2027-01-04

About the assignment

We are looking for a hands-on DevOps Engineer to lead the migration of our client's R&D engineering platform from on-prem Azure DevOps Server to Azure DevOps Services, harden build infrastructure, and migrate teams from TeamCity to Azure Pipelines. The role combines migration planning and execution, platform hardening, and ongoing platform operation for a large estate (dozens of projects, ~400 Git repos, ~6 TB collection DB, ~100 Windows container images and self-hosted agents). The role requires driving network and identity requests through IT and working carefully with some older/EOL target hosts; avoid unplanned reboots. The consultant will own both the new platform and a legacy CI system retained long-term, and should be comfortable with that dual responsibility.

Responsibilities

• Primary: TFS to Azure DevOps Services migration:
• Plan and execute the staged migration path ADO Server 2020.1 -> ADO Server 2022.2 -> Azure DevOps Services using the Microsoft Data Migration Tool.
• Run repeated trial imports into a test organization, document and fix findings, and perform the production import with cutover and rollback plans.
• Reduce the ~6 TB collection database to an importable size via retention tuning and artifact cleanup without touching production.
• Handle identity mapping (AD -> Entra ID), Entra groups and group-based licensing, and recreate or migrate service connections, variable groups, secure files, branch policies, service hooks, extensions and wikis.
• Plan and execute agent re-enrollment and update pipelines that reference on-prem URLs.
• Migration risk handling:
• Identify and mitigate work-item and commit-link risks including ID collisions and ReflectedWorkItemId mapping.
• Move teams from TeamCity to Azure Pipelines:
• Inventory TeamCity projects, translate build chains, templates and meta-runners to YAML pipelines and shared templates, and provide migration guidance and pairing support to teams.
• Keep TeamCity stable for legacy use, including backups, patching, agent maintenance and documentation for long-term retainment.
• Cloud platform and artifacts:
• Migrate container images to Azure Container Registry and NuGet/npm packages to Azure Artifacts; abstract registry/feed URLs for a one-switch cutover and redirect internal DNS where needed.
• Design and operate elastic build capacity with Azure VMSS agent pools, scale-to-zero and cost optimisation.
• Run and improve the platform:
• Maintain build agent health and images (Windows and Linux), Docker host hygiene, pipeline observability and cost reporting.
• Implement supply-chain security measures: SBOM generation, vulnerability scanning, code signing, secrets handling and service principal/managed identity lifecycle.
• Perform incident analysis and produce clear written post-mortems.

Requirements

Mandatory

• Strong hands-on Azure DevOps (Server and/or Services): repos, pipelines (YAML and classic), agent pools, service connections, variable groups, permissions, REST API.
• Experience with Azure DevOps Server upgrades and/or Azure DevOps Services imports/migrations.
• PowerShell (5.1 and 7) scripting for automation, REST calls and migration tooling; Bash for Linux hosts.
• Git at an advanced level (mirror clones, history rewriting, large repo handling).
• Azure fundamentals: Entra ID (users, groups, service principals, group-based licensing), ACR, Azure Artifacts, networking basics (VNet, private endpoints, NSG), RBAC.
• Docker - Windows and Linux containers, registries, image build/push pipelines.
• Windows Server administration (IIS-hosted services, services, scheduled tasks) and Linux administration.
• Solid understanding of CI/CD concepts, build agents and artifact management.
• Clear written communication in English; ability to produce migration plans, runbooks and risk analyses.

Nice-to-have

• TeamCity administration and authoring (build chains, templates, meta-runners, VCS roots, agents, server migration/backup) and experience migrating teams away from it.
• SQL Server administration (upgrade, backup/restore, detach/attach collection, large DB maintenance).
• Azure VMSS / elastic agent pools and cost optimisation.
• Legacy process template (XML) -> Inherited process conversion.
• Firewall/proxy/TLS troubleshooting in enterprise environments.
• Security hardening of build infrastructure (separation of service accounts, least privilege, secret and credential rotation, patch baselines) and awareness of the EU Cyber Resilience Act (SBOM, vulnerability handling, long-term maintainability of legacy products).
• Cross-domain / cross-tenant identity and project migration (co-op domain -> Entra ID).
• Building lean, reproducible build agent images (Windows 11 + Docker CE + agent).
• GitHub Enterprise and GitHub Apps (token-based automation), GitHub Actions.
• Infrastructure as code (Bicep / Terraform / ARM), cloud-init.
• Yocto / embedded build pipelines, Windows CE / embedded OS build experience.
• Code signing, SBOM (CycloneDX), Dependency-Track, container scanning (Docker Scout, Trivy).
• Python or.NET for tooling.
• Nginx reverse proxy / TLS, Linux Docker host troubleshooting (bridge/veth, conntrack).