Hilltop Partner Network (HPN) is seeking an experienced, highly autonomous Senior DevOps Consultant to manage, harden, and optimize the cloud infrastructure powering our proprietary, AI-first consulting management platform. This part-time contract role is structured specifically to support a lean technical team. The incoming consultant must operate as a hands-on individual contributor and primary doer, not as an AI supervisor, engagement manager, or lead of a bench of junior or offshore resources.

The consultant will serve as a critical technical co-pilot to the CTO by directly executing Azure workplace management, Terraform codebase maintenance, and deployment pipeline work, thereby insulating our full-stack developers to maintain high-velocity feature delivery and QA automation.

Role Overview and Commercial Terms

- Position Title: Senior DevOps Consultant (SaaS & Cloud Infrastructure)
- Engagement Model: Part-Time Independent Consultant Agreement
- Time Commitment: Capped at 8 hours per week (1 business day equivalent) with absolute 'pens down' enforcement on routine tasks
- Hourly Compensation: $100.00 – $120.00 CAD per hour (commensurate with senior-tier technical expertise)
- Location: 100% Remote (Winnipeg, MB or Western Canada region preferred)
- Reporting Structure: Reports directly to the Chief Technology Officer (CTO)

Strategic Mandate & Resourcing Context

Following the transition of our engineering team to a budget-neutral resourcing model, HPN has reallocated capacity to establish a tight technical focus. Previously, senior full-stack resources were heavily bogged down by complex, routine DevOps workloads (including network segregation, vulnerability remediation, and CI/CD maintenance), impacting feature velocity. Under the new resourcing model, HPN is transitioning core developers to pure-play feature coding and automated QA testing.

The Senior DevOps Consultant represents our critical infrastructure safeguard. By owning the continuous stability, compliance, and performance of our Azure and GitHub pipelines, the consultant ensures that our internal developers remain 100% insulated from infrastructure friction. In parallel, the role enforces strict infrastructure cost control and security standards, enabling enterprise-ready operations on a highly disciplined startup budget.

Key Areas of Accountability The Senior DevOps Consultant will maintain absolute hands-on ownership of the following domains. HPN expects the consultant to perform the work directly; responsibilities may not be delegated to lower-tier staff, subcontracted delivery benches, AI-only operational oversight models, or unmanaged third-party resources without prior written approval.

- Infrastructure as Code (IaC) Management: Maintain, refactor, and secure the ha-infrastructure and terraform-modules repositories on Azure. Uphold a strict code-first infrastructure model, ensuring that 100% of staging and production services are defined declaratively in Terraform, totally eliminating untracked manual portal modifications.
- CI/CD Pipeline & Orchestration Ownership: Manage and optimize GitHub Actions and Azure workflows across Censtra's modular repositories.



This includes the Next.js NextAuth/tRPC front-end portal (t3portal), asynchronous background task queues (automation-worker, notifications-worker), and our Python-based AI RAG document processing pipeline (rfx-processing).
- Network Security & Environment Hardening: Enforce strict logical and network segregation between the Staging and Production virtual networks (VNets). Maintain private network security, including configuring Network Security Groups (NSGs), routing traffic via Private Endpoints, managing the Point-to-Site (P2S) VPN Gateway, and executing our roadmap goal of migrating the VPN to Entra ID (Azure AD) federated authentication for seamless user lifecycle management.
- Secrets Management & Application Compliance: Own Azure Key Vault integrations. Ensure that all runtime credentials, PostgreSQL database connection strings, OIDC federated identity trust relationships, and API integrations (e.g., BoldSign e-signatures, Braintree payments, and private Azure OpenAI endpoints) are securely injected via Managed Identities, completely eliminating static secrets and credential leakage in commit histories.
- Azure Secure Score Automation & Maintenance: Help automate and operationalize maintenance of our Azure Secure Score above the baseline target of 85% by improving monitoring, alerting, reporting, and remediation workflows across Microsoft Defender for Cloud and integrated repository scanners (Semgrep, ESLint, pip-audit). The consultant should focus on building repeatable automation, guardrails, and escalation paths that enable our internal team to efficiently manage CVEs, dependency upgrades, and Docker base image Ubuntu package updates, rather than manually owning routine vulnerability remediation work that our team is capable of handling directly.
- Operational Cost Control & Right-Sizing: Execute cloud cost-optimization strategies. Lead the decommissioning of redundant/legacy cloud resources (e.g., consolidating premium private Azure DNS zones to yield immediate recurring monthly savings). Implement auto-scaling policies, right-size database tiers (PostgreSQL Flexible Server auto-grow parameters), and configure strict Tokens Per Minute (TPM) ceilings in Azure AI Studio to prevent catastrophic run-away token billing overages.

Infrastructure Governance & Process Standards To protect live environments, the consultant must strictly adhere to and champion our established Azure Infrastructure Change Protocol. This workflow ensures that technical agility is never prioritized at the expense of production stability:

1. No Ad-Hoc Portal Changes: All infrastructure modifications - including temporary test resource provisioning - must reside in code via Pull Requests inside our Terraform repository.



Manual modifications in the Azure Portal are strictly prohibited.
2. Spike Before Execution: Any changes altering core cloud assets (DNS resolvers, database schemas, IAM boundaries, subnets) must begin as a time-boxed Spike ticket in Azure DevOps to map dependencies and analyze downstream blast-radius risk.
3. Blast-Radius Communication: Before merging any Terraform Pull Request, the consultant is responsible for issuing a formatted warning in central dev channels, declaring the scope, affected resources, and potential instability window.
4. Deployment Verification & Rollback Procedures: All deployments must follow a clear release cadence (Staging deployment on merge to main; Production tagging for release). In the event of critical failures, the consultant must be prepared to execute immediate Tier 1 mitigations (e.g., Azure Container Apps revision traffic shifting) and source-control rollbacks.

Technical Requirements & Qualifications The ideal candidate must demonstrate deep technical mastery and the ability to operate with extreme autonomy:

- Minimum 8-10 years of professional software development and system administration experience, with a heavy emphasis on cloud architecture and automation.
- Demonstrated mastery of Microsoft Azure PaaS environments, specifically Azure Container Apps, Azure Functions (consumption & premium tiers), Azure Key Vault, Private Endpoints, virtual networks, and Log Analytics/Application Insights.
- Advanced proficiency in Terraform, including designing modular, reusable modules, managing secure remote state backends, and configuring OIDC federated identity providers.
- Expert knowledge of GitHub Actions CI/CD orchestration, including branch protection rules, mandatory quality checks, automated dependency updates (Dependabot), and deployment security rules.
- Solid foundation in DevSecOps principles, including static code analysis (Semgrep, ESLint), secrets scanning, and automated container image scanning.
- Deep understanding of database and storage architectures, including PostgreSQL management (Prisma ORM configurations), Azure Storage Queues, and Dockerized graph databases (Neo4j).
- Familiarity with AI/ML cloud hosting infrastructure (Azure OpenAI Service, TPM/RPM quota budgeting, private network integration for AI services) is highly desirable.
- Strong, structured communication skills - able to coordinate release planning with developers and maintain lean, up-to-date engineering wiki documentation.
- Proven ability to operate as an independent contractor, managing deliverables strictly within a tight 8-hour weekly time budget.
- Hands-on individual contributor model is required: the consultant must personally perform technical implementation, troubleshooting, reviews, and operational follow-through rather than acting primarily as an AI tool operator, task supervisor, or manager of lower-tier delivery resources.

How to Apply

Interested candidates should submit their resume to [email protected] with the email subject line “Senior DevOps Consultant.” Candidates should also include a brief note outlining their relevant Azure, Terraform, CI/CD, and DevSecOps automation experience.

📌 Senior DevOps Consultant (part-time contract) (Canada)
🏢 Hilltop Partner Network
📍 Canada