Enterprise Systems Lead

ZS is a place where passion changes lives. As a management consulting and technology firm focused on improving life and how we live it, we transform ideas into impact by bringing together data, science, technology and human ingenuity to deliver better outcomes for all. Here you’ll work side-by-side with a powerful collective of thinkers and experts shaping life-changing solutions for patients, caregivers and consumers, worldwide. ZSers drive impact by bringing a client-first mentality to each and every engagement. We partner collaboratively with our clients to develop custom solutions and technology products that create value and deliver company results across critical areas of their business. Bring your curiosity for learning, bold ideas, courage and passion to drive life-changing impact to ZS. What you'll do: Enterprise Systems Lead in the Enterprise will.. Own the architecture of the ZS Azure estate end to end: tenant and management group hierarchy, subscription topology, landing zones, hub-and-spoke networking, VNet integration, private endpoints and Private DNS, firewalls and load balancing, resource group standards and environment separation for internal and client-facing workloads. Define and enforce governance through Azure Policy, RBAC, tagging standards (client, project, cost center, environment), quota management and Azure Cost Management, so that cost allocation and chargeback across roughly 30 client tenants and growing is accurate and scalable. Provide architecture and hands-on guidance for the Azure services ZS runs on: App Service, Azure Functions, Azure Kubernetes Service, Azure Container Apps, API Management, Azure Virtual Desktop, Storage, Key Vault and related services; advise data science and delivery teams on scalable, billable and secure designs such as per-client subscriptions for multi-tenant GenAI workloads. Own Azure security posture with the SOC and Information Protection teams: Defender for Cloud recommendations, Key Vault secrets and certificate lifecycle, network exposure decisions (for example refusing public-facing VMs and offering compliant alternatives) and project-code mapping of resource groups with Finance. Design and govern the enterprise API layer on Azure API Management: authentication and authorisation, network placement, policies, throttling and backend integrations to internal and client-facing services. Deliver Azure infrastructure as code (Bicep or Terraform) through Azure DevOps: Repos, YAML Pipelines, service connections, environments with approvals, and Boards for work tracking. Move remaining portal-built resources into version-controlled, repeatable deployments. Design and run the CI/CD pattern for platform and application infrastructure, including environment promotion (dev, sub-production, production), secrets handling through Key Vault, policy-as-code checks and drift detection. Administer and govern the Azure DevOps organisation used by Enterprise Systems, including repositories, pipelines, service connections, permissions, security and integrations, and support tooling migrations that touch it, such as the Azure DevOps Boards to Jira migration. Automate repetitive operations (certificate renewals, access provisioning, tagging remediation, cost reports) with pipelines, Azure Automation or PowerShell and Azure CLI, and measure the reduction in manual effort and tickets. Support containerised application platforms and deployments on AKS and Azure Container Apps, including container registries, image and secret handling, ingress and private networking, and the CI/CD pipelines that ship to them. Own Azure Monitor and Log Analytics alerting, including the Purview Information Protection (label downgrade) alert rules and Action Groups that create ServiceNow incidents for the SOC, and keep that pipeline reliable end to end. Investigate gaps and failures using KQL, ingestion-latency analysis and event reconciliation; produce clear root-cause write-ups with findings, recommended changes and next steps for security and IT stakeholders. Manage platform certificates and secrets (Azure Key Vault, RD Web and Azure Virtual Desktop SSL renewals), Function App networking and private connectivity so that internal applications remain reachable and secure. Drive down recurring ticket volume from system-health issues by working with Cloud Operations and vendors on permanent fixes rather than repeated workarounds. Provide the Azure foundation for ZS AI programs: Azure AI Foundry and Azure OpenAI resources, Azure AI Search indexes, Function Apps, API Management, private networking and Key Vault configuration that Copilot agents and internal knowledge agents depend on. Support Microsoft 365 Copilot and Copilot Studio agent enablement from the platform side: Entra security groups that govern agent access, publishing Foundry agents to Teams, SharePoint and Microsoft Graph integrations for enterprise search and knowledge solutions, and the identity and network prerequisites raised by implementation partners. Maintain working, hands-on familiarity with Power Platform (Power Apps, Power Automate, Dataverse), Power BI and Microsoft Fabric, including secure connectivity from those services to enterprise systems and the managed production environment behind the ZS Technical Assistance Center AI Agent, working with the IT Manager for Enterprise Systems who leads that area day to day. Give practical guidance to project teams on hosting AI tools within ZS Azure infrastructure, including approved use of enterprise LLM providers, and route requests through the AI Assist Intake Form where appropriate. Design and support identity and application security on Microsoft Entra ID: app registrations and enterprise applications, OAuth 2.0 and OpenID Connect, Microsoft Graph permissions, managed identities, RBAC and Privileged Identity Management, applying least privilege throughout. Act as the decision point for access requests that carry risk, such as external client or contrac