Sandbox Platform Engineer

Sandbox Platform Engineer

Assignment type: 6 month contract (outside IR35)

The Sandbox Platform Engineer is responsible for delivering and operationalising the TMHCC International Sandbox Platform in line with the agreed Sandbox Strategy and architecture.

The engagement will build a secure, automated and supportable platform that enables teams to provision temporary environments for development, testing, proof-of-concept and technology evaluation use cases, while maintaining appropriate security, governance, cost and lifecycle controls.

This is a hands-on delivery engagement focused on implementing a defined platform and associated technical deliverables. The engineer is expected to determine the appropriate technical approach within established architectural, security and technology guardrails.

Scope of Services

Sandbox Platform Design & Delivery

Implement the Sandbox Platform in line with the approved Sandbox Strategy, roadmap and architecture.

Translate the agreed target state into detailed technical designs, engineering tasks, and deployable platform components.

Build the Azure platform foundations required to support isolated sandbox workloads and temporary environments.

Support sandbox use cases including temporary Windows and Linux virtual machines, developer workstations, proof-of-concept environments and short-lived application infrastructure.

Evaluate and implement Microsoft Dev Box, Azure Virtual Desktop, Azure Deployment Environments or equivalent approved services where they provide the best fit for a defined use case.

Validate the platform through representative pilot use cases before transitioning into service.

Infrastructure as Code (IaC) & Automation

Develop and maintain reusable Terraform modules and Ansible Playbooks for the Sandbox Platform in GitHub Enterprise Cloud.

Ensure platform Infrastructure as Code is version-controlled in GitHub and deployed through approved automated deployment workflows.

Automate sandbox provisioning, configuration and decommissioning to minimise manual administration.

Define and recommend standard deployment patterns for common sandbox requirements and formalise agreed patterns through reusable automation.

Contribute to the definition of a centralised environment management capability and ensure sandbox deployments publish the required ownership, lifecycle, status and cost metadata to the agreed platform.

Implement automated expiry, shutdown, reclamation and deletion controls for temporary resources.

Embed appropriate validation, approval policy compliance and automated security checks within deployment workflows, integrating with approved enterprise security tooling where applicable.

Identity, Security & Governance

Integrate the platform with Microsoft Entra ID and approved role-based access control (RBAC) patterns.

Implement privileged access using established PIM/JIT and least-privilege principles where applicable.

Apply Azure Policy and corporate security guardrails appropriate to sandbox environments.

Work with Security and Architecture stakeholders to ensure controls protect the wider environment without unnecessarily restricting legitimate sandbox use cases.

Implement appropriate audit logging, monitoring and security visibility.

Ensure secrets and credentials are managed using approved secure patterns.

Connectivity & Environment Isolation

Implement network isolation appropriate to the sandbox use cases and agreed architecture.

Ensure sandbox environments do not introduce unnecessary connectivity or trust relationships with the corporate production network.

Configure Azure networking, routing, DNS and firewall controls required for approved sandbox patterns.

Support controlled access to sandbox resources through approved remote-access methods.

Where required, support designs using separate subscriptions, management groups or tenancy boundaries to achieve the necessary level of isolation.

Lifecycle, Cost & Governance Controls

Implement tagging standards, ownership metadata, expiry dates and environment classification.

Implement budgets, cost reporting and controls to provide visibility of sandbox consumption.

Design the platform to minimise the cost of idle or short-lived environments.

Implement automated shutdown and deallocation where appropriate.

Provide controls to identify and remove orphaned or expired resources.

Establish clear boundaries between sandbox experimentation and production services.

End User Experience & Standard Patterns

Provide simple, repeatable ways for users to request or provision approved sandbox environments.

Create standard patterns for temporary Windows and Linux machines and other common sandbox scenarios.

Reduce the need for bespoke engineering by exposing reusable platform capabilities through automation.

Document user-facing guidance covering access, permitted use, lifecycle, security and cost responsibilities.

Support initial consumers of the service and incorporate lessons learned into the final platform.

Operationalisation & Handover

Produce platform documentation, support procedures and operational runbooks.

Define platform ownership, support boundaries and escalation routes.

Provide knowledge transfer to the TMHCC internal teams.

Ensure all delivered code, configuration and documentation is stored in approved corporate repositories and aligned with current platform engineering standards and practices.

Resolve defects identified during pilot delivery and hand over a supportable service at the end of the engagement.

Sandbox Platform Engineer - Sept 2026.docx 3

Engagement Deliverables

Detailed Sandbox Platform design aligned to the approved strategy and architecture.

Azure platform foundations, subscription structure and required isolation controls.

Infrastructure-as-Code repository containing reusable platform modules and deployment workflows.

Automated provisioning and decommissioning capability.

Automated environment expiry, shutdown and reclamation controls.

Standard Windows and Linux sandbox patterns.

Developer workstation capability, including Microsoft Dev Box where appropriate.

Identity, RBAC and privileged-access integration.

Azure Policy, security guardrails and logging integration.

Network and remote-access configuration required for approved sandbox patterns.

Tagging, budget and cost-management controls.

Completed pilot sandbox use cases with identified defects resolved.

Operational documentation, user guidance and support runbooks.

Knowledge transfer and formal handover to the Hosting and Cloud Platform Teams.

Engagement Approach

Takes ownership of agreed technical deliverables and drives them through to completion.

Operates with an automation-first mindset and avoids unnecessary manual platform configuration.

Works independently within agreed architectural, security and technology constraints.

Identifies and resolves delivery blockers proactively, escalating dependencies where stakeholder input is required.

Communicates clearly with technical and non-technical stakeholders.

Focuses on repeatable platform services and measurable outcomes rather than general BAU engineering activity.

Maintains strong attention to security, auditability, governance and operational supportability.

Additional Engagement Requirements

The engagement is focused on the delivery of the agreed Sandbox Platform and associated technical outputs rather than the provision of general Cloud or Hosting BAU resource.

The engineer will work with relevant TMHCC stakeholders where technical dependencies, access, approvals or design decisions require client input.

The engagement is expected to conclude following delivery, acceptance, knowledge transfer and handover of the agreed platform and documentation.