Founding Principal Azure Cloud & Multi-Tenant SaaS Architect

# Founding Principal Azure Cloud & Multi-Tenant SaaS Architect **Company:** Kodaowl, Inc. **Location:** Remote — United States Preferred **Employment Type:** Part-Time / Flexible Engagement **Seniority:** Principal / Staff / Founding Engineer **Industry:** Cybersecurity | Cloud Infrastructure | Multi-Tenant SaaS | AI-Native Platforms ## About Kodaowl Kodaowl is an early-stage cybersecurity technology company developing an AI-native, multi-tenant SaaS platform designed to transform how organizations discover, assess, prioritize, remediate, and validate cybersecurity exposures and risks. Our platform integrates asset discovery, vulnerability assessment, threat and vulnerability intelligence, contextual risk prioritization, remediation management, validation, and AI-assisted security analysis. Our mission is to move beyond conventional vulnerability reporting toward continuous, evidence-driven exposure and risk management. **Decide with Evidence. Act with Confidence.** We are building a scalable cybersecurity platform designed to serve organizations ranging from small businesses to enterprise customers. ## About the Role We are seeking a **Founding Principal Azure Cloud & Multi-Tenant SaaS Architect** to lead the architecture, implementation, security, and operational readiness of Kodaowl's Microsoft Azure infrastructure. This is a senior, hands-on technical leadership role with direct responsibility for establishing a secure, scalable, reliable, and cost-efficient cloud foundation for a commercial cybersecurity SaaS platform. Kodaowl has established five Azure subscriptions covering platform management, security, development, staging, and production. The selected architect will begin by conducting a comprehensive assessment of the existing Azure environment, identifying configuration gaps, and establishing the architecture required to deploy and operate Kodaowl's application. The role requires extensive practical experience with Azure infrastructure, multi-tenant SaaS architecture, cloud security, networking, containerized applications, databases, infrastructure automation, and production operations. **We are not seeking an architect who only produces diagrams or recommendations. We need an experienced technical leader who can design, implement, validate, troubleshoot, document, and operationalize the infrastructure.** You will collaborate directly with the founder, application engineers, AI engineers, and cybersecurity specialists to prepare Kodaowl for commercialization and long-term growth. ## Key Responsibilities ### 1. Azure Foundation Assessment & Architecture Conduct a comprehensive technical assessment of Kodaowl's existing Azure environment before deploying additional resources. Responsibilities include: * Review Azure tenant and Microsoft Entra ID configurations. * Assess the existing five subscriptions and management group hierarchy. * Evaluate subscription ownership, administrative access, and RBAC assignments. * Review Azure Policy, governance controls, and inherited configurations. * Examine billing arrangements, budgets, subscription restrictions, and resource quotas. * Identify existing resources, configurations, security gaps, and architectural risks. * Evaluate regional availability, networking requirements, and service dependencies. * Establish an Azure foundation readiness assessment with prioritized recommendations. * Develop a practical implementation roadmap aligned with product commercialization requirements. The architect must preserve existing configurations where appropriate and avoid unnecessary infrastructure complexity or expense. ### 2. Azure Landing Zone & Cloud Governance Design and implement a secure, scalable Azure foundation using the existing subscription structure. Responsibilities include: * Establish appropriate management group and subscription governance. * Implement Azure Policy and resource governance standards. * Define resource naming conventions, tagging, and ownership. * Configure Azure RBAC and least-privilege access controls. * Implement managed identities and secure service authentication. * Establish administrative separation between development, staging, production, and security operations. * Configure cost management, budgets, monitoring, and resource controls. * Develop reusable infrastructure patterns and deployment standards. * Ensure the architecture can evolve without requiring unnecessary subscription proliferation. The design should balance enterprise-grade security and governance with the operational and financial realities of an early-stage company. ### 3. Multi-Tenant SaaS Architecture Design and implement infrastructure supporting a secure, scalable, multi-tenant cybersecurity SaaS platform. Responsibilities include: * Define shared and isolated infrastructure components. * Design tenant-aware application deployment and service architecture. * Collaborate with application engineers on tenant isolation and authorization boundaries. * Establish secure communication between application services, databases, scanning workers, and AI components. * Design independently scalable application and background-processing services. * Support tenant-specific resource limits, workload scheduling, and usage controls. * Establish approaches for preventing cross-tenant data access and workload interference. * Evaluate shared versus dedicated infrastructure requirements for enterprise customers. * Design infrastructure capable of supporting increasing customer counts, asset volumes, and concurrent scanning workloads. The architect must understand that multi-tenancy requires coordinated controls across application logic, data access, identities, networking, and infrastructure. ### 4. Azure Networking & Security Architecture Design and implement secure Azure networking and connectivity. Relevant technologies include: * Azure Virtual Networks and subnets. * Network Security Groups. * Azure Private Link and private endpoints. * Azure Private DNS. * VNet peering and routing. * Azure Load Balancer and application ingress technologies. * Azure Firewall or alternative network controls where justified. * Azure DDoS protection options. * Secure outbound connectivity and network segmentation. Responsibilities include: * Design secure communication between platform components. * Establish appropriate public and private access boundaries. * Protect databases and internal services from unnecessary public exposure. * Isolate production workloads from development environments. * Implement network segmentation for scanning infrastructure. * Establish controlled outbound access for vulnerability assessment workloads. * Protect internal cloud infrastructure against unauthorized scanning, lateral movement, and access to sensitive platform services. * Document network architecture and security controls. ### 5. Application Infrastructure & Deployment Design and deploy the infrastructure required to host Kodaowl's existing application. Current technologies include: * Python and FastAPI. * PostgreSQL and SQLAlchemy. * Docker containers. * REST APIs. * Background workers and scanning services. * Web application components. * AI/LLM integration services. Responsibilities include: * Evaluate Azure Container Apps, Azure App Service, Azure Virtual Machines, and Azure Kubernetes Service based on actual requirements. * Recommend a practical, cost-efficient hosting architecture. * Deploy and configure application services. * Establish secure database connectivity. * Configure application secrets and environment settings. * Implement health monitoring, scaling, and recovery mechanisms. * Establish deployment processes across development, staging, and production. * Collaborate with application engineers to resolve deployment and infrastructure issues. The initial implementation should favor operational simplicity without compromising essential security and reliability. ### 6. PostgreSQL & Data Infrastructure Design and implement reliable, secure, and scalable database infrastructure. Responsibilities include: * Evaluate and configure Azure Database for PostgreSQL or appropriate alternatives. * Establish secure database access and network isolation. * Implement encryption and secret management. * Define backup, retention, and recovery procedures. * Support application-level tenant isolation and data access controls. * Evaluate database performance, connection management, and scaling requirements. * Implement monitoring and performance optimization. * Establish recovery testing and data protection procedures. * Support future database scaling and enterprise customer requirements. ### 7. Secure Vulnerability Scanning Infrastructure Kodaowl's cybersecurity platform requires specialized infrastructure for vulnerability assessment and exposure discovery. The architect will design secure, scalable execution environments for authorized scanning activities. Responsibilities include: * Design isolated scanning worker infrastructure. * Support tools such as Nmap, Nuclei, Trivy, and other approved assessment technologies. * Establish secure workload scheduling and execution boundaries. * Implement queue-based scanning orchestration infrastructure. * Support controlled scaling based on scan demand. * Define appropriate network restrictions and outbound connectivity. * Prevent scanning workloads from accessing unauthorized internal resources. * Establish workload resource limits and execution safeguards. * Support tenant-specific scanning quotas and workload isolation. * Implement logging, monitoring, and failure recovery for scanning operations. The architect will collaborate with cybersecurity engineers to ensure scanning infrastructure supports authorized assessments while protecting Kodaowl's platform and other customers. ### 8. AI & Security Intelligence Infrastructure Support the infrastructure required for Kodaowl's AI-assisted cybersecurity capabilities. Responsibilities include: * Design secure integration with LLM providers and Azure AI services where appropriate. * Support AI inference and background intelligence-processing workloads. * Establish secure access to AI-related credentials and services. * Implement usage monitoring and cost controls. * Support tenant-aware AI processing and data protection. * Evaluate managed versus self-hosted AI infrastructure based on cost, performance, and security. * Collaborate with AI engineers to maintain flexibility across model providers. * Ensure AI infrastructure can scale independently of scanning and application services. ### 9. Infrastructure as Code & CI/CD Establish repeatable, version-controlled infrastructure and application deployment processes. Responsibilities include: * Develop infrastructure using Terraform, Azure Bicep, or appropriate infrastructure-as-code technologies. * Implement reusable infrastructure modules. * Establish secure source control and change management. * Configure CI/CD pipelines using Azure DevOps, GitHub Actions, or comparable technologies. * Automate deployment across development, staging, and production. * Implement appropriate approval controls for production changes. * Establish infrastructure testing and configuration validation. * Document deployment, rollback, and recovery procedures. * Minimize manual configuration and configuration drift. ### 10. Cloud Security, Monitoring & Operational Resilience Establish security and operational controls appropriate for a commercial cybersecurity platform. Responsibilities include: * Configure Azure Monitor, Log Analytics, and relevant diagnostic settings. * Evaluate and implement Microsoft Defender for Cloud capabilities where justified. * Establish centralized infrastructure monitoring and alerting. * Implement secure administrative access and identity controls. * Configure Azure Key Vault and appropriate secrets management. * Establish backup and disaster recovery strategies. * Define recovery time and recovery point objectives. * Implement infrastructure health checks and operational alerts. * Support security reviews, vulnerability assessments, and configuration audits. * Establish operational runbooks and incident response procedures. * Validate recovery processes through practical testing. ### 11. Performance, Scalability & Cost Optimization Design infrastructure that supports Kodaowl's initial commercialization while providing a clear path to future expansion. Responsibilities include: * Establish resource sizing and capacity planning methodologies. * Evaluate performance requirements for application services, databases, scanning workers, and AI workloads. * Implement appropriate horizontal and vertical scaling strategies. * Monitor infrastructure utilization and operational costs. * Establish cost allocation and budget alerts. * Identify opportunities to reduce unnecessary cloud expenses. * Evaluate managed services against simpler deployment alternatives. * Design for increasing customer demand without premature infrastructure complexity. * Establish capacity and performance testing approaches. * Monitor Azure service quotas and identify potential scaling constraints. ### 12. Technical Leadership & Engineering Collaboration Serve as the technical owner of Kodaowl's Azure infrastructure. Responsibilities include: * Collaborate directly with the founder on infrastructure priorities and architectural decisions. * Coordinate with application engineers on deployment and integration. * Work with AI engineers on intelligence-processing infrastructure. * Collaborate with vulnerability management specialists on secure scanning execution. * Participate in technical design reviews and engineering planning. * Identify architectural risks, dependencies, and implementation tradeoffs. * Establish infrastructure documentation and engineering standards. * Provide clear progress updates, technical recommendations, and implementation status. * Support production readiness assessments and operational handover. ## Required Qualifications * Extensive hands-on experience designing, implementing, and operating production infrastructure on Microsoft Azure. * Demonstrated experience architecting and deploying commercial multi-tenant SaaS applications. * Strong knowledge of Azure subscriptions, management groups, governance, and landing zone architecture. * Deep understanding of Microsoft Entra ID, Azure RBAC, managed identities, and cloud security. * Strong Azure networking expertise, including VNets, NSGs, routing, DNS, and private connectivity. * Experience deploying containerized applications and distributed services. * Practical experience with Azure Container Apps, AKS, App Service, or comparable Azure hosting technologies. * Experience with PostgreSQL or other production relational databases. * Proficiency with Terraform, Azure Bicep, or equivalent infrastructure automation. * Experience implementing CI/CD pipelines and automated deployments. * Strong understanding of multi-tenant security, workload isolation, scalability, and reliability. * Experience with cloud monitoring, logging, backup, and disaster recovery. * Ability to independently implement and troubleshoot infrastructure. * Strong technical communication and documentation skills. * Experience working collaboratively with application engineering teams. **Direct, hands-on Azure production experience and multi-tenant SaaS implementation experience are essential.** ## Preferred Qualifications * Experience architecting cybersecurity SaaS products. * Familiarity with vulnerability scanning infrastructure and security assessment workloads. * Experience deploying Python/FastAPI applications. * Experience with PostgreSQL and SQLAlchemy-based applications. * Familiarity with asynchronous workers, messaging systems, and job orchestration. * Experience designing secure multi-tenant data architectures. * Knowledge of Azure AI services and LLM infrastructure. * Experience with cloud cost optimization in early-stage startups. * Familiarity with enterprise security frameworks and compliance requirements. * Experience implementing infrastructure for high-volume background processing. * Relevant Microsoft Azure certifications, such as Azure Solutions Architect Expert or Azure DevOps Engineer Expert. Certifications are beneficial but are not substitutes for demonstrated production implementation experience. ## Initial Priorities & Expected Deliverables The selected architect will be expected to establish and progressively implement the following: **Azure Foundation Readiness Assessment** Review existing subscriptions, governance, identity, security, networking, billing, quotas, and operational configurations. Document findings and recommend corrective actions. **Target SaaS Architecture** Produce an implementation-ready architecture covering application services, PostgreSQL, scanning infrastructure, AI integration, networking, tenant isolation, security, and scalability. **Development Environment Deployment** Deploy Kodaowl's existing application and supporting infrastructure in Azure Development, with verified connectivity, operational monitoring, and secure configuration. **Staging & Production Readiness** Establish repeatable deployments, environment separation, security controls, backup procedures, monitoring, and production release processes. **Scalability & Operational Handover** Document infrastructure, establish operating procedures, validate scaling and recovery mechanisms, and provide clear guidance for future growth. All deliverables should be supported by working configurations, documentation, and appropriate technical validation. ## What Success Looks Like Success in this role means Kodaowl has: * A verified, secure, and appropriately governed Azure foundation. * A functioning multi-tenant SaaS deployment. * Reliable application and database infrastructure. * Secure, isolated, and scalable vulnerability scanning workloads. * Repeatable infrastructure and application deployments. * Effective monitoring, logging, backup, and recovery procedures. * Practical cost controls and capacity planning. * A documented architecture that supports commercialization and future growth. ## Engagement & Growth Opportunity This is an initial part-time opportunity with flexible scheduling, designed for an experienced Azure architect who can contribute directly to building Kodaowl's production infrastructure. The position offers significant architectural ownership and the opportunity to influence the technical direction of an emerging cybersecurity platform. The scope and level of involvement may expand as Kodaowl progresses through commercialization and customer growth. Compensation and engagement terms will be discussed based on experience, availability, responsibilities, and the company's stage of development. ## Why Join Kodaowl? Kodaowl offers an opportunity to help build a cybersecurity SaaS platform from its foundational infrastructure through commercialization. You will have meaningful ownership over cloud architecture, infrastructure implementation, security, scalability, and operational readiness. You will work directly with the founder and engineering team, influence critical technical decisions, and help establish the infrastructure supporting a new generation of evidence-driven cybersecurity capabilities. We value hands-on expertise, technical rigor, practical problem-solving, architectural discipline, security, cost efficiency, and accountable execution. **Help build the secure, scalable cloud foundation for Kodaowl's next-generation cybersecurity platform.**