Cloud Engineer

About Us

Dymon Asia Capital is a Singapore headquartered multi-strategy hedge fund managing approximately USD 5 billion in assets. Founded in Singapore and built around Asian markets, we run a range of strategies across macro, commodities, and systematic trading. We employ around 350 people across nine offices globally, with Singapore as our headquarters and primary technology hub. We are regulated by the Monetary Authority of Singapore and operate under the regulatory regimes of the markets in which we invest.

The IT Infrastructure function is organized across four pillars: Network, Windows, Linux, and Cloud. It is a lean six-person team of senior engineers, working in close partnership with the Cybersecurity function and with the trading and research desks it supports.

We are engaging Cloud Engineers on contract to deliver two linked programs: remediation of the existing Azure estate against agreed security and configuration standards and build out of the network landing zone to receive application workloads migrating from on premises. You will sit inside the infrastructure team for the duration of the engagement, reporting to the Cloud Solutions Architect.

This is a delivery role, not a design role. Architecture is set by the Cloud Solutions Architect and the Network Architect. You build, test, migrate, document, and hand over against that architecture. Because the team is small, you will need to be self-directed and make progress without daily supervision, while raising design conflicts early rather than working around them. Work is measured on completed, documented, and handed-over outcomes, and knowledge transfer to the permanent team is an explicit deliverable rather than a closing task. Uptime and latency affect trading and research directly, so change discipline and tested rollback are not negotiable.

Key Responsibilities

. Remediate findings from cloud security posture reviews, vulnerability scans, and audit observations against agreed target-state configuration, tracking progress against a defined backlog with evidence of closure.

. Harden Azure resource configuration in line with defined baselines, covering storage, compute, networking, key management, and logging.

. Implement Azure Policy, tagging standards, and governance guardrails across subscriptions and management groups, correct RBAC and privileged role assignments, and clean up legacy and orphaned resources.

. Build landing zone components to the design provided, including subscription and resource group structure, spoke virtual networks, subnets, route tables, security groups, private endpoints, and private DNS zones.

. Configure hybrid connectivity components including VPN Gateway, ExpressRoute, and peering, and implement firewall rules to the agreed segmentation model with each rule mapped to a documented business requirement.

. Deploy landing zone components as infrastructure as code where practical, so the build is repeatable rather than click-configured.

. Assess candidate applications for migration, capturing dependencies, connectivity requirements, data flows, and constraints.

. Execute migration waves to Azure infrastructure and platform services, including build, data transfer, testing, cutover, and rollback, coordinating windows with application owners and the Windows and Linux teams.

. Validate performance, resilience, backup, and monitoring coverage before workloads are accepted as live, configure logging and alerting so telemetry reaches the security operations function, and decommission source infrastructure once formally approved.

. Produce as-built documentation and runbooks, progress all changes through the firm's change management process with tested rollback, work within the firm's security standards and MAS Technology Risk Management alignment, and provide structured knowledge transfer to the permanent team at agreed milestones.

Requirements

. 5 or more years of hands-on Azure engineering experience, with demonstrable delivery on migration or remediation programs.

. Track record of executing to an architecture defined by others, working within established standards and formal change control.

. Azure core services at operational depth, including compute, storage, networking, Azure Policy, RBAC, and resource governance.

. Azure networking, including virtual networks, subnets, security groups, route tables, private endpoints, private DNS, VPN Gateway, and ExpressRoute.

. Identity and secrets management, including Entra ID, RBAC, Privileged Identity Management, Key Vault, and managed identities.

. Infrastructure as code and automation using Terraform or Bicep, PowerShell, Azure CLI, and CI/CD pipelines.

. Migration tooling, including Azure Migrate, Site Recovery, backup and replication tooling, and dependency mapping.

. Operational tooling, including Azure Monitor, Log Analytics, alerting, and cost visibility.

. Experience in a regulated environment, and comfortable operating under least privileged, time-bound privileged access with strict data handling requirements. Financial services experience is advantageous.

. Available to work onsite in Singapore and to support agreed out-of-hours cutover windows, disciplined about documenting as you go, and able to clear the firm's background screening and third-party access requirements before engagement start.

Preferred certifications: AZ-104 Azure Administrator Associate.AZ-500 Azure Security Engineer Associate and AZ-700 Azure Network Engineer Associate are advantageous.