Azure DevOps · Platform Engineering

Robert Rothermel CI/CD and Azure platform engineering for regulated, compliance-driven environments.

Five years of production Azure: I led a colocated datacenter → Azure migration, built the CI/CD pipeline that took releases from ~2 hours to ~20 minutes, and implemented the cloud-side SOC 2 controls that pass an auditor's review. My focus now: compliance-grounded pipelines and private, policy-governed Azure landing-zone design for regulated environments.

Azure AKS · App Service · Front Door · Private Networking IaC Bicep · Terraform · Pulumi CI/CD Azure DevOps · GitHub Actions Compliance SOC 2 · Entra · Defender Observability OpenTelemetry · Prometheus · Grafana · Jaeger

Get in touch Résumé (PDF) LinkedIn GitHub

What I do

The intersection most Azure DevOps candidates only cover half of: shipping pipelines and making them survive an audit.

◆ Azure platform & migration

Designed and executed a colocated datacenter → Azure migration for production SaaS workloads — subscriptions, networking, Azure DevOps, and cutover. Now building private hub-and-spoke landing zones with private endpoints and policy guardrails.

◆ CI/CD that gates itself

Multi-stage Azure DevOps pipelines with canary slots, telemetry health gates that fail closed, and automatic promote-or-rollback. The go/no-go decision is made by data, not a human watching a dashboard.

◆ Compliance, built in

SOC 2 cloud controls — Entra identity, conditional access, Defender, change-management gates — implemented so the pipeline produces the audit evidence instead of someone assembling it after the fact.

Selected engineering work

One system I built and ran for eight months, plus clean-room builds and designs that isolate one hard problem each — runnable repositories, not slideware.

◆ Operated system · On-premises · Oct 2025 – May 2026

TvSignalRouter — Event-Driven Market-Data Platform

A self-hosted .NET 10 platform that ingests inbound webhook signals, persists signals and positions to SQL Server, applies risk and validation gates, and captures live market data — deployed as a Windows service via staged PowerShell onto on-premises infrastructure. Built and operated over eight months.

Demonstrates: the full operational loop rather than a demonstration — OpenTelemetry instrumentation exporting to Jaeger (tracing), Prometheus (metrics), Grafana (dashboards) and Loki (logs), with Alertmanager driving 81 alert rules over a purpose-built metric taxonomy — order fill latency, connection and keepalive failures, execution-adapter fallback. Eight self-hosted CI pipelines gate every run on a 6,000-case test suite, including automated post-deploy observability validation.

.NET 10 / C#OpenTelemetryPrometheusGrafanaJaegerLokiAlertmanagerSQL ServerPowerShellWindows serviceWoodpecker CI / Gitea

Architected and directed · built with a multi-agent AI development fleet Walkthrough on request →

◇ CI/CD · Build artifact

Canary Deployment with Automated Health Gating

Ships a .NET app to an Azure App Service canary slot, routes 10% of live traffic, then promotes or rolls back automatically based on Application Insights telemetry — no human in the go/no-go loop.

Demonstrates: a telemetry gate that fails closed — insufficient signal defaults to rollback, never promotion. The clean-room design of the pipeline that cut my production release time from ~2h to ~20m — companion to the node-CVE build below.

Azure DevOps YAMLBicepApp Insights / KQLASP.NET Core 8PowerShell 7

Design + reference pattern Read the design →

◇ AKS · Security · SOC 2

Gated AKS Node-CVE Remediation

Treats a CVE-patched AKS node image as a promotable, gated artifact — staged, canaried in a tainted prod nodepool, regression-tested, PDB-protected on promotion, then verified against Defender — instead of an in-place --node-image-only upgrade that makes production the first place the new image runs.

Demonstrates: compliance-grounded automation. A clean-room reference implementation whose stages map to SOC 2 controls — CC7.1, CC8.1, CC6.x, A1.x — with every reduction in rigor approver-gated and logged as risk-acceptance.

AKSDefender for ContainersKubernetes (PDB)BicepKQL gateSOC 2 TSC

Bicep · 8 PowerShell gates · k8s · KQL · Pester · SOC 2 map Read the design →

◇ Architecture · System design

Blue/Green Private Azure Landing Zone

A private-only hub-and-spoke design connecting Databricks, two AKS clusters, and three Container Apps environments — all PaaS via private endpoints, no public IPs, east-west forced through an Azure Firewall, blue/green cutover as a single Pulumi config flip.

Demonstrates: senior architecture judgment — choosing the blue/green seam by where state is cheap, central private-DNS strategy, CNI-overlay IP planning, and CrossGuard policy-as-code enforcing "private-only."

Pulumi (C# / AzureNative)Hub-and-spokePrivate EndpointsPrivate DNSAKS · ACA · Databricks

Design doc + component plan Read the design →

◇ IaC · Hands-on lab

Terraform: State, Drift & Refactor Lab

A single stack that chains the mechanics that actually break real Terraform estates — backend state locking, for_each/dynamic, validated variables, import of out-of-band resources, refresh-only vs. apply drift handling, and a zero-diff module refactor with moved blocks.

Demonstrates: IaC fluency beyond "terraform apply" — the state-hygiene and refactoring discipline that separates a cert from hands-on capability.

Terraform 1.10+State / lockingModules & movedLocalStack

Lab write-up + runbook Read the design →

TvSignalRouter is a system I independently built and operated. The four builds below it are clean-room demonstrations of patterns I've shipped in production, isolated so the mechanics are easy to review. None are the property of any prior employer. Design records are published; the implementations are walked through live.

Experience

Workforce- and visitor-management SaaS for regulated and compliance-driven industries — offshore drilling, manufacturing, healthcare, and union-restricted facilities.

DevOps Engineer — Savance, LLC

Commerce, MI · Nov 2019 – Jul 2023

Sole DevOps / platform engineer — owned the Azure migration, CI/CD, the SOC 2 program, and product integrations end to end.

Led the colocated datacenter → Azure lift-and-shift as program owner — designed the migration, stood up the App Service + Azure SQL environment, chose Azure Front Door (WAF) over Azure Firewall, and ran production cutovers with monitoring and validation (including an Azure SQL query-optimizer fix: 20 min → sub-second).
Built and operated the Microsoft-stack CI/CD pipeline in Azure DevOps, cutting production releases from ~2 hours of manual deploy-and-verify to ~20 minutes; sole Azure DevOps administrator for branch policies, access, and release gating.
Drove the company's SOC 2 program — hosted the internal audits on a GRC platform (Sprinto), implemented org-wide MFA and Azure AD Conditional Access, least-privilege RBAC, Snyk code scanning, and TLS hardening, and drove the PCI "stop storing card data" decision.
Shipped software: led the FedCheck background-check integration from vendor selection through data-model and UI specs to merge into the v11 release candidate, deployed the access-control integration services that bridge customer access-control systems into the cloud-hosted SaaS (Windows service / Linux container), coordinated the Angular 14 modernization of five web apps delivered by the offshore team, and built a reusable C# USB device library stable across sleep/restart/port changes on 70+ mustering tablets.
Owned the hardware integration portfolio (Brivo, Kantech, C-Cure, Lenel, Genetec, AMAG + Gemalto/DYMO/RFIdeas SDKs), automated kiosk provisioning in PowerShell (~30 → ~3 min/unit), and stood up Datadog RUM / Application Insights observability.

Software Support / Implementation Engineer — Savance, LLC

Commerce, MI · Aug 2018 – Nov 2019

Primary technical contact for new-customer rollouts and administrator onboarding across on-prem IIS, SQL Server, and Windows; built SSRS reporting and authored 40+ knowledge-base articles that cut repeat tickets.

Career Break — Family Caregiving

2023 – Present

Stepped away from full-time work to care for a family member who has since passed away. I stayed technically current throughout: completed an M.S. in Information Technology (Arizona State University), earned Microsoft's AZ-400 (DevOps Engineer Expert) and AZ-104, and built clean-room Azure DevOps reference implementations — a gated AKS node-CVE remediation pipeline, a self-gating canary deployment, a private Azure landing-zone design, and a Terraform state/drift/refactor lab. I also designed, built, and operated TvSignalRouter (above) for eight months — a self-hosted .NET 10 platform deployed as a Windows service, with on-premises CI/CD and a full OpenTelemetry observability stack. Now focused on returning to a senior full-time Azure DevOps / platform role.

Credentials & stack

Re-establishing a current, legible baseline after the break — paired with the hands-on builds above so it's never "certified but never shipped it."

Earned

Microsoft Certified: DevOps Engineer Expert

AZ-400 · certified July 2026 · verify ↗

Earned

Microsoft Certified: Azure Administrator Associate

AZ-104 · certified June 2026 · verify ↗

Prep

HashiCorp Certified: Terraform Associate (003/004)

hands-on lab built; cert is filter-clearing, the repo is the proof

Earned

M.S., Information Technology

Focus: Information Systems Management · Arizona State University

Azure

AKSApp ServiceFront Door (WAF)VNet / Private EndpointsEntra ID (Azure AD)Azure SQLDefender for CloudMonitor / App Insights / KQLKey Vault

IaC & CI/CD

BicepTerraformPulumiAzure DevOps PipelinesGitHub ActionsSelf-hosted CI (Woodpecker / Gitea)Windows service deploymentOPA / Policy-as-code

Observability

OpenTelemetryPrometheusGrafanaJaegerLokiAlertmanagerApp Insights / KQLDatadogSerilog

Languages

C# / .NETPowerShellPythonBashT-SQLKQL

Security & compliance

SOC 2 (TSC)Conditional Access / MFARBAC / IAMGRC automation (Sprinto)SnykTLS hardening

Let's talk infrastructure.

Open to senior Azure DevOps / platform engineering roles. If you're modernizing pipelines, standing up a private Azure landing zone, or prepping a SOC 2 audit, I can take ownership from day one. U.S. citizen — eligible for federal and cleared work.

robert@quantize.engineering github.com/quantize-engineering