Sandbox Platform Engineer

Responsibilities

• 6 month contract (outside IR35) The Sandbox Platform Engineer is responsible for delivering and operationalising the TMHCC International Sandbox Platform in line with the agreed Sandbox Strategy and architecture.
• The engagement will build a secure, automated and supportable platform that enables teams to provision temporary environments for development, testing, proof-of-concept and technology evaluation use cases, while maintaining appropriate security, governance, cost and lifecycle controls.
• This is a hands-on delivery engagement focused on implementing a defined platform and associated technical deliverables.
• The engineer is expected to determine the appropriate technical approach within established architectural, security and technology guardrails.
• Scope of Services Sandbox Platform Design & Delivery Implement the Sandbox Platform in line with the approved Sandbox Strategy, roadmap and architecture.
• Translate the agreed target state into detailed technical designs, engineering tasks, and deployable platform components.
• Build the Azure platform foundations required to support isolated sandbox workloads and temporary environments.
• Support sandbox use cases including temporary Windows and Linux virtual machines, developer workstations, proof-of-concept environments and short-lived application infrastructure.
• Evaluate and implement Microsoft Dev Box, Azure Virtual Desktop, Azure Deployment Environments or equivalent approved services where they provide the best fit for a defined use case.
• Validate the platform through representative pilot use cases before transitioning into service.
• Infrastructure as Code (IaC) & Automation Develop and maintain reusable Terraform modules and Ansible Playbooks for the Sandbox Platform in GitHub Enterprise Cloud.
• Ensure platform Infrastructure as Code is version-controlled in GitHub and deployed through approved automated deployment workflows.
• Automate sandbox provisioning, configuration and decommissioning to minimise manual administration.
• Define and recommend standard deployment patterns for common sandbox requirements and formalise agreed patterns through reusable automation.
• Contribute to the definition of a centralised environment management capability and ensure sandbox deployments publish the required ownership, lifecycle, status and cost metadata to the agreed platform.
• Implement automated expiry, shutdown, reclamation and deletion controls for temporary resources.
• Embed appropriate validation, approval policy compliance and automated security checks within deployment workflows, integrating with approved enterprise security tooling where applicable.
• Identity, Security & Governance Integrate the platform with Microsoft Entra ID and approved role-based access control (RBAC) patterns.
• Implement privileged access using established PIM/JIT and least-privilege principles where applicable.
• Azure Policy and corporate security guardrails appropriate to sandbox environments.
• Work with Security and Architecture stakeholders to ensure controls protect the wider environment without unnecessarily restricting legitimate sandbox use cases.
• Implement appropriate audit logging, monitoring and security visibility.
• Ensure secrets and credentials are managed using approved secure patterns.
• Connectivity & Environment Isolation Implement network isolation appropriate to the sandbox use cases and agreed architecture.
• Ensure sandbox environments do not introduce unnecessary connectivity or trust relationships with the corporate production network.
• Configure Azure networking, routing, DNS and firewall controls required for approved sandbox patterns.
• Support controlled access to sandbox resources through approved remote-access methods.
• Where required, support designs using separate subscriptions, management groups or tenancy boundaries to achieve the necessary level of isolation.
• Lifecycle, Cost & Governance Controls Implement tagging standards, ownership metadata, expiry dates and environment classification.
• Implement budgets, cost reporting and controls to provide visibility of sandbox consumption.
• Design the platform to minimise the cost of idle or short-lived environments.
• Implement automated shutdown and deallocation where appropriate.
• Provide controls to identify and remove orphaned or expired resources.
• Establish clear boundaries between sandbox experimentation and production services.
• End User Experience & Standard Patterns Provide simple, repeatable ways for users to request or provision approved sandbox environments.
• Create standard patterns for temporary Windows and Linux machines and other common sandbox scenarios.
• Reduce the need for bespoke engineering by exposing reusable platform capabilities through automation.
• Document user-facing guidance covering access, permitted use, lifecycle, security and cost responsibilities.
• Support initial consumers of the service and incorporate lessons learned into the final platform.
• Operationalisation & Handover Produce platform documentation, support procedures and operational runbooks.
• Define platform ownership, support boundaries and escalation routes.
• Provide knowledge transfer to the TMHCC internal teams.
• Ensure all delivered code, configuration and documentation is stored in approved corporate repositories and aligned with current platform engineering standards and practices.
• Resolve defects identified during pilot delivery and hand over a supportable service at the end of the engagement.
• Sandbox Platform Engineer - Sept 2026.docx 3 Engagement Deliverables Detailed Sandbox Platform design aligned to the approved strategy and architecture.
• Azure platform foundations, subscription structure and required isolation controls.
• Infrastructure-as-Code repository containing reusable platform modules and deployment workflows.
• Automated provisioning and decommissioning capability.
• Automated environment expiry, shutdown and reclamation controls.
• Standard Windows and Linux sandbox patterns.
• Developer workstation capability, including Microsoft Dev Box where appropriate.
• Identity, RBAC and privileged-access integration.
• Azure Policy, security guardrails and logging integration.
• Network and remote-access configuration required for approved sandbox patterns.
• Tagging, budget and cost-management controls.
• Completed pilot sandbox use cases with identified defects resolved.
• Operational documentation, user guidance and support runbooks.
• Knowledge transfer and formal handover to the Hosting and Cloud Platform Teams.
• Engagement Approach Takes ownership of agreed technical deliverables and drives them through to completion.
• Operates with an automation-first mindset and avoids unnecessary manual platform configuration.
• Works independently within agreed architectural, security and technology constraints.
• Identifies and resolves delivery blockers proactively, escalating dependencies where stakeholder input is required.
• Communicates clearly with technical and non-technical stakeholders.
• Focuses on repeatable platform services and measurable outcomes rather than general BAU engineering activity.
• Maintains strong attention to security, auditability, governance and operational supportability.
• Additional Engagement Requirements The engagement is focused on the delivery of the agreed Sandbox Platform and associated technical outputs rather than the provision of general Cloud or Hosting BAU resource.
• The engineer will work with relevant TMHCC stakeholders where technical dependencies, access, approvals or design decisions require client input.
• The engagement is expected to conclude following delivery, acceptance, knowledge transfer and handover of the agreed platform and documentation.