We're a midsize company with roughly 1,000 users. Our IT environment is fairly mature: we're heavily virtualized, run a hybrid on-premises and cloud setup, and have a solid sysadmin team, although our Azure experience could be stronger.
Our software development efforts, however, have been a mess. Much of the work is outsourced overseas, projects arrive without clear infrastructure or security requirements, and the developers often don't seem to know what they need. Recent applications have been built in Blazor despite concerns about the approach, and several mobile app projects have failed badly. We've also seen code concentrated in a single DLL, little documentation, passwords stored in plaintext, poor understanding of HTTPS and Key Vault, resistance to change control, and limited understanding of CI/CD pipelines.
Would hiring a senior DevOps or platform engineer help? Could that person review code, define infrastructure requirements, improve Azure practices, and guide the developers? Or is the real gap a development manager, architect, or engineering leader? We're trying to figure out how to regain control and set reasonable technical and security standards.
5 Answers
A senior DevOps or platform engineer could be very useful, especially for Azure architecture, reusable infrastructure, CI/CD templates, monitoring, and secure defaults. They can also review code from an operational and security perspective, but they shouldn’t be expected to replace a competent development lead. The developers still need someone who owns application architecture and engineering practices.
Before hiring permanently, consider bringing in an experienced Azure architect or engineering consultant for a short engagement. Have them establish the landing zone, deployment standards, security controls, requirements template, and a workable pipeline. Then your existing sysadmins or a permanent platform engineer can operate and improve it. Your sysadmins being solid is an advantage, but they shouldn’t be responsible for fixing the development organization by themselves.
Don’t get too focused on the single DLL or lack of comments yet. Those may be symptoms, but plaintext credentials, missing HTTPS, unclear ownership, and an inability to produce a repeatable deployment are the urgent risks. Define the minimum security and operational requirements first, make them part of the definition of done, and enforce as much as possible through automated checks and cloud policy.
This sounds primarily like an engineering leadership and accountability problem, not simply a missing infrastructure hire. Someone senior needs ownership of technical standards, non-functional requirements, architecture, release criteria, and the authority to reject work that doesn’t meet them. Without that, a DevOps hire may just build pipelines that repeatedly deliver poor-quality software.
The outsourcing agreement matters too. Security, documentation, testing, deployment, and infrastructure requirements need to be written into the contract and treated as acceptance criteria. Otherwise every improvement becomes a negotiation over unpaid work.
The team needs a senior in-house technical owner, and possibly a development manager, rather than just another administrator. Basic practices such as source control, testing, code review, secure secret handling, documented deployment, and change management should be mandatory. If the outsourced developers consistently cannot meet those standards, replacing or restructuring that arrangement may be more effective than trying to supervise every bad decision.
I’d test this immediately: use a clean build agent and see whether your company can build, deploy, and recreate an environment without the vendor’s help. If you can’t, you have a serious ownership and transferability problem, not just untidy code.
The best setup is usually a platform person who makes the safe path easy, rather than a gatekeeper manually approving everything. Use managed identities and Key Vault, enforce HTTPS, add secret and dependency scanning, and apply cloud policies so common mistakes are blocked automatically.