About CalcAir At CalcAir, we've been helping employee benefit professionals breathe easier for over 50 years — and we're just getting started. As a trusted name in benefits software and services, we blend deep industry roots with a forward-thinking mindset. CalcAir is part of the Gemini Group, one of the operating groups within Constellation Software Inc. (CSI). Being under CSI—a global leader in vertical market software—means we benefit from the stability, innovation, and long-term investment philosophy of a world-class software organization, while still operating with the agility and culture of a specialized team. Join a team where experience meets innovation, and where your work truly shapes the future of how people work, plan, and retire. If you're ready to make an impact, grow your career, and have a little fun along the way, CalcAir might be the perfect fit. Learn more about us here: CalcAir: Gemini: Role summary We're hiring a hands-on Cloud Infrastructure Engineer to help mature the Azure environment behind our new web products, making it more secure, repeatable, and cost-efficient as we grow. We have a working foundation in Azure. As the product grows, we're investing in maturing our processes: broader infrastructure-as-code coverage, stronger security practices, and better documentation across dev, QA, and production. You'll work side by side with our Azure Cloud Infrastructure & Applications Support Specialist as a partner, sharing ownership of our infrastructure and adding capacity as our needs grow. Your focus will lean toward the cloud product, working closely with our Modernization development team to design and deploy the infrastructure behind our cloud-native SaaS web application. You'll build it with Terraform, keeping security and compliance in mind as your main priority. Cost management and licensing are shared with the Specialist. Our tech stack • Cloud: Azure • Infrastructure as code: Terraform • Delivery and tooling: GitHub, GitHub Actions, Azure DevOps (ADO) boards, Claude Code What you'll accomplish in your first year 1. First 90 days: Learn our current Azure environment, processes, and costs alongside the team. Extend Terraform coverage so dev, QA, and production stay consistent. Strengthen budgets and cost alerts. 2. By 6 months: Expand automated vulnerability scanning across our build pipelines and environments. Help coordinate third-party penetration testing and track remediation. Help formalize and document our security policies. 3. By 12 months: Help bring our controls, evidence, and documentation to the level needed for a SOC 2 audit. Keep cloud spend predictable and tied to clear owners. Responsibilities Cloud infrastructure • Design, deploy, and maintain our Azure infrastructure in Terraform, including networking, identity, compute, databases, storage, and monitoring. • Help manage our dev, QA, and production environments, improving consistency and how changes move between them. • Work with developers on CI/CD pipelines, deployment practices, and infrastructure needs for web applications and APIs. • Improve monitoring, logging, alerting, backup, and disaster recovery practices. • Track infrastructure work in Azure DevOps (ADO) boards, and stay in sync with the Modernization team's work in Linear. Security and compliance • Help mature our security practices for a SaaS web product, aligned with SOC 2. • Run and expand vulnerability scanning for code, dependencies, containers, and cloud configuration. • Coordinate penetration tests with outside firms, and track findings through remediation. • Contribute to and maintain security documentation: policies, procedures, incident response plan, access reviews, and audit evidence. • Manage identity and access in Azure using least privilege, and handle secrets and key management. Cost and licensing • Share responsibility for Azure cost management: budgets, alerts, tagging, right-sizing, reservations, and monthly cost reporting. • Evaluate and manage licensing for cloud, security, and developer tools, and keep an inventory of what we pay for. • Recommend tradeoffs between cost, security, and reliability in plain language for leadership. AI tools • Use AI tools, including Claude Code, to speed up infrastructure, scripting, documentation, and security work. • Help the team adopt AI tooling securely, with sensible data and access controls. Required qualifications • 4+ years in cloud infrastructure, DevOps, or systems engineering, with at least 2 years hands-on in Azure. • Strong Terraform experience building and maintaining production infrastructure. • Experience running separate dev, QA, and production environments for web applications. • Experience building and maintaining CI/CD pipelines, ideally in GitHub Actions. • Working knowledge of web application security, including OWASP Top 10, identity, network security, and secrets management. • Hands-on experience with vulnerability scanning tools and remediating their findings. • A track record of reducing or controlling cloud costs, with examples you can walk us through. • A collaborative working style: comfortable sharing ownership, writing clear documentation, and explaining tradeoffs to non-technical leaders. • Regular use of AI tools such as Claude Code in your work, with good judgment about where they help and where they don't. Nice to have • Has helped a company prepare for or pass a SOC 2 audit. • Microsoft certifications such as AZ-104 (Azure Administrator), AZ-500 (Azure Security Engineer), or AZ-400 (DevOps Engineer). • Experience with Microsoft Defender for Cloud, Microsoft Sentinel, or similar security tools. • Familiarity with Azure DevOps (ADO) boards and pipelines. • FinOps experience or certification. • Experience at a small or growing software company, helping processes mature as the business scales. Reporting, location, and compensation • Reports to: Adam Moore, Director of Engineering and Technology. • Works with: Our Azure Cloud Infrastructure & Applications Support Specialist as a close partner, along with the Modernization development team and Product. • Location: Remote, U.S.-based. Includes on-call support for production issues, shared with the Specialist, plus occasional after-hours patching and deployments. • Compensation: Eligibility for two bonus programs and a strong benefits package. FLSA Designation (US Only): ExemptSalary Range: The estimated base salary range for this role is USD$90,000.00 - USD$110,000.00 per year. We include salary ranges in job postings only where required by applicable pay transparency laws, based on the jurisdictions in which the role may be performed. The posted range is a good faith estimate and reflects factors that are subject to change. Final offer amounts may vary based on job-related factors, including work location, candidate experience and expertise, and other relevant considerations.Other Compensation (US Only): This role will also be eligible for participation in a Company profit sharing bonus plan. Plan details will be provided to you upon hire.Benefits (US Only): Full time employees will also be eligible for enrollment in a wide range of choices of benefits , including medical, dental, vision, basic life insurance, short/long term disability, 401(k) participation (with company match).Time off (US Only): The Company provides a minimum of 10 days of vacation for new employees , sick time based on state requirements, 8 Company-paid holidays and 2 personal holidays per year.We recognize the value and importance of diversity and inclusion in our communities and in the workplace. We celebrate diversity and one of our goals as an employer is to create an inclusive work environment for all employees. We are an equal opportunity employer and do not discriminate against any employee or applicant because of race, religion, sex, sexual orientation including gender identity or expression, pregnancy, national origin, age, marital status, veteran status, disability status, or any other category or characteristic protected by law.Applicants with disabilities who would like to require a reasonable accommodation related to any part of the application process may contact us at : If an applicant is selected to receive a conditional offer of employment, and in accordance with applicable law, a criminal background check may be conducted before the offer becomes final and employment begins. Pursuant to the San Francisco Fair Chance Ordinance, and other applicable laws, we will consider for employment qualified applicants with arrest and conviction records.#CalcairOriginally posted on Himalayas