We are seeking a Cloud Architect to join the CCoE and own the enterprise AWS landing zone, reference architectures, and self-service platform that deliver secure, compliant, cost-aware infrastructure, acting as the hands-on design authority who aligns security, networking, FinOps, and application teams to balance developer velocity with resilience and financial accountability. Responsibilities Own the AWS Organizations/Control Tower landing zone, including OU hierarchy, baselines, and centralized logging Maintain SCPs, Config rules, and conformance packs with controlled break-glass access Centralize identity via IAM Identity Center with permission sets, federation, and ABAC Enforce a tagging taxonomy and tag policies for cost, ownership, automation, and reporting Run account factory/self-service provisioning with enforced tags and approvals Manage change, detect drift, and remediate at scale Publish AWS Well-Architected reference architectures and lead Well-Architected Reviews Design VPC segmentation, Transit Gateway/Cloud WAN, hybrid links, and NGFW with Gateway Load Balancer inspection Define workload landing patterns across IaaS, managed services, and serverless with clear trade-offs Lead 7-R migrations and portfolio sequencing, chair design boards, and own resilience, DR, and multi-region strategy Build the self-service cloud/internal developer platform with codified guardrails Set Terraform module standards, registry strategy, and GitOps workflows, and run golden-image and container platform patch/promotion trains Requirements At least 1 year of experience as a Software Architect Experience owning multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized logging Expertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspection Expertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module design Hands-on experience with governance tools such as SCPs, IAM Identity Center, and tagging strategy Background in authoring enterprise reference architectures and serving as cross-team design authority Exceptional communication skills with the ability to influence engineers and executives alike Knowledge of AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vending Knowledge of IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patterns Knowledge of VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspection Knowledge of Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP) Knowledge of EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and Fargate Knowledge of CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets management Proficiency in English at a B2+ level
