Impress employers and recruiters.
Choose from hundreds of resume examples.

Target Resume Now

Tailor your resume to this Sandbox Platform Engineer role.

Rezi rewrites your resume against Tokio Marine HCC's job description. Free.

Resume score gauge reading 58 out of 100

Don't guess if your resume is good enough.

See how it scores against the Sandbox Platform Engineer posting at Tokio Marine HCC — free, in seconds.

About the Role

The Sandbox Platform Engineer is responsible for delivering and operationalising the TMHCC International Sandbox Platform in line with the agreed Sandbox Strategy and architecture. The engagement will build a secure, automated and supportable platform that enables teams to provision temporary environments for development, testing, proof-of-concept and technology evaluation use cases, while maintaining appropriate security, governance, cost and lifecycle controls. This is a hands-on delivery engagement focused on implementing a defined platform and associated technical deliverables. The engineer is expected to determine the appropriate technical approach within established architectural, security and technology guardrails.

Responsibilities

Implement the Sandbox Platform in line with the approved Sandbox Strategy, roadmap and architecture.
Translate the agreed target state into detailed technical designs, engineering tasks, and deployable platform components.
Build the Azure platform foundations required to support isolated sandbox workloads and temporary environments.
Support sandbox use cases including temporary Windows and Linux virtual machines, developer workstations, proof-of-concept environments and short-lived application infrastructure.
Evaluate and implement Microsoft Dev Box, Azure Virtual Desktop, Azure Deployment Environments or equivalent approved services where they provide the best fit for a defined use case.
Validate the platform through representative pilot use cases before transitioning into service.
Develop and maintain reusable Terraform modules and Ansible Playbooks for the Sandbox Platform in GitHub Enterprise Cloud.
Ensure platform Infrastructure as Code is version-controlled in GitHub and deployed through approved automated deployment workflows.
Automate sandbox provisioning, configuration and decommissioning to minimise manual administration.
Define and recommend standard deployment patterns for common sandbox requirements and formalise agreed patterns through reusable automation.
Contribute to the definition of a centralised environment management capability and ensure sandbox deployments publish the required ownership, lifecycle, status and cost metadata to the agreed platform.
Implement automated expiry, shutdown, reclamation and deletion controls for temporary resources.
Embed appropriate validation, approval policy compliance and automated security checks within deployment workflows, integrating with approved enterprise security tooling where applicable.
Integrate the platform with Microsoft Entra ID and approved role-based access control (RBAC) patterns.
Implement privileged access using established PIM/JIT and least-privilege principles where applicable.
Apply Azure Policy and corporate security guardrails appropriate to sandbox environments.
Work with Security and Architecture stakeholders to ensure controls protect the wider environment without unnecessarily restricting legitimate sandbox use cases.
Implement appropriate audit logging, monitoring and security visibility.
Ensure secrets and credentials are managed using approved secure patterns.
Implement network isolation appropriate to the sandbox use cases and agreed architecture.
Ensure sandbox environments do not introduce unnecessary connectivity or trust relationships with the corporate production network.
Configure Azure networking, routing, DNS and firewall controls required for approved sandbox patterns.
Support controlled access to sandbox resources through approved remote-access methods.
Where required, support designs using separate subscriptions, management groups or tenancy boundaries to achieve the necessary level of isolation.
Implement tagging standards, ownership metadata, expiry dates and environment classification.
Implement budgets, cost reporting and controls to provide visibility of sandbox consumption.
Design the platform to minimise the cost of idle or short-lived environments.
Implement automated shutdown and deallocation where appropriate.
Provide controls to identify and remove orphaned or expired resources.
Establish clear boundaries between sandbox experimentation and production services.
Provide simple, repeatable ways for users to request or provision approved sandbox environments.
Create standard patterns for temporary Windows and Linux machines and other common sandbox scenarios.
Reduce the need for bespoke engineering by exposing reusable platform capabilities through automation.
Document user-facing guidance covering access, permitted use, lifecycle, security and cost responsibilities.
Support initial consumers of the service and incorporate lessons learned into the final platform.
Produce platform documentation, support procedures and operational runbooks.
Define platform ownership, support boundaries and escalation routes.
Provide knowledge transfer to the TMHCC internal teams.
Ensure all delivered code, configuration and documentation is stored in approved corporate repositories and aligned with current platform engineering standards and practices.
Resolve defects identified during pilot delivery and hand over a supportable service at the end of the engagement.
Takes ownership of agreed technical deliverables and drives them through to completion.
Operates with an automation-first mindset and avoids unnecessary manual platform configuration.
Works independently within agreed architectural, security and technology constraints.
Identifies and resolves delivery blockers proactively, escalating dependencies where stakeholder input is required.
Communicates clearly with technical and non-technical stakeholders.
Focuses on repeatable platform services and measurable outcomes rather than general BAU engineering activity.
Maintains strong attention to security, auditability, governance and operational supportability.
The engineer will work with relevant TMHCC stakeholders where technical dependencies, access, approvals or design decisions require client input.
The engagement is expected to conclude following delivery, acceptance, knowledge transfer and handover of the agreed platform and documentation.

Requirements

Deliver and operationalise the TMHCC International Sandbox Platform.
Build a secure, automated, and supportable platform.
Determine appropriate technical approach within established guardrails.
Implement the Sandbox Platform in line with the approved Sandbox Strategy, roadmap and architecture.
Translate target state into detailed technical designs, engineering tasks, and deployable platform components.
Build Azure platform foundations for isolated sandbox workloads and temporary environments.
Support sandbox use cases including temporary Windows and Linux VMs, developer workstations, proof-of-concept environments, and short-lived application infrastructure.
Evaluate and implement Microsoft Dev Box, Azure Virtual Desktop, Azure Deployment Environments, or equivalent approved services.
Validate the platform through representative pilot use cases.
Develop and maintain reusable Terraform modules and Ansible Playbooks in GitHub Enterprise Cloud.
Ensure platform Infrastructure as Code is version-controlled in GitHub and deployed through automated workflows.
Automate sandbox provisioning, configuration, and decommissioning.
Define and recommend standard deployment patterns for common sandbox requirements.
Contribute to the definition of a centralised environment management capability.
Implement automated expiry, shutdown, reclamation, and deletion controls for temporary resources.
Embed validation, approval policy compliance, and automated security checks within deployment workflows.
Integrate the platform with Microsoft Entra ID and approved RBAC patterns.
Implement privileged access using PIM/JIT and least-privilege principles.
Apply Azure Policy and corporate security guardrails.
Work with Security and Architecture stakeholders to ensure controls protect the wider environment.
Implement appropriate audit logging, monitoring, and security visibility.
Ensure secrets and credentials are managed using approved secure patterns.
Implement network isolation appropriate to sandbox use cases and agreed architecture.
Ensure sandbox environments do not introduce unnecessary connectivity or trust relationships with the corporate production network.
Configure Azure networking, routing, DNS, and firewall controls.
Support controlled access to sandbox resources through approved remote-access methods.
Support designs using separate subscriptions, management groups, or tenancy boundaries for isolation.
Implement tagging standards, ownership metadata, expiry dates, and environment classification.
Implement budgets, cost reporting, and controls for sandbox consumption visibility.
Design the platform to minimise the cost of idle or short-lived environments.
Implement automated shutdown and deallocation where appropriate.
Provide controls to identify and remove orphaned or expired resources.
Establish clear boundaries between sandbox experimentation and production services.
Provide simple, repeatable ways for users to request or provision approved sandbox environments.
Create standard patterns for temporary Windows and Linux machines and other common sandbox scenarios.
Reduce the need for bespoke engineering by exposing reusable platform capabilities through automation.
Document user-facing guidance covering access, permitted use, lifecycle, security, and cost responsibilities.
Support initial consumers of the service and incorporate lessons learned.
Produce platform documentation, support procedures, and operational runbooks.
Define platform ownership, support boundaries, and escalation routes.
Provide knowledge transfer to TMHCC internal teams.
Ensure all delivered code, configuration, and documentation is stored in approved corporate repositories and aligned with current platform engineering standards and practices.
Resolve defects identified during pilot delivery and hand over a supportable service.
Take ownership of agreed technical deliverables and drive them to completion.
Operate with an automation-first mindset.
Work independently within agreed architectural, security, and technology constraints.
Identify and resolve delivery blockers proactively, escalating dependencies where stakeholder input is required.
Communicate clearly with technical and non-technical stakeholders.
Focus on repeatable platform services and measurable outcomes.
Maintain strong attention to security, auditability, governance, and operational supportability.
Work with relevant TMHCC stakeholders where technical dependencies, access, approvals, or design decisions require client input.
The engagement is focused on the delivery of the agreed Sandbox Platform and associated technical outputs rather than the provision of general Cloud or Hosting BAU resource.

Skills

Azure
Microsoft Dev Box
Azure Virtual Desktop
Azure Deployment Environments
Terraform
Ansible Playbooks
GitHub Enterprise Cloud
Infrastructure as Code (IaC)
Microsoft Entra ID
Role-Based Access Control (RBAC)
Privileged Access Management (PIM)
Just-In-Time (JIT) access
Azure Policy
Audit Logging
Monitoring
Network Isolation
Azure Networking
Routing
DNS
Firewall Controls
Tagging Standards
Cost Management
Automation
Security
Governance
Operational Supportability

Location

Remote

Work Type

Contract
Outside IR35

Experience Level

Mid-level
Senior

About the Company

TMHCC International