AWS Cloud Architect-Infrastructure Background

Job description

Role & responsibilities We are seeking a hands-on AWS Senior Cloud Infrastructure Architect to lead cloud operations and engineering for a large, multi-account, multi-cloud enterprise environment. The role sits across two motions: keeping a complex, VM-heavy AWS estate running reliably (operations), and driving forward-looking architecture, automation and cloud-consolidation work (engineering). The architect will work directly with customer stakeholders in architecture reviews, planning sessions and governance forums, and will be expected to reason clearly about root cause, risk and trade-offs under time pressure including live P1 scenarios. KEY RESPONSIBILITIES Cloud Operations (Run) • Own day-to-day operational health of a large multi-account AWS environment (60+ accounts, 500+ resources largely VMs) • Lead root-cause analysis and remediation for P1 incidents, including network path failures, guardrail drift and policy-inheritance issues • Manage ticket-based support, escalations and SLA/SLO adherence • Monitor and maintain Control Tower guardrail compliance; identify and remediate drift without breaking legitimate exceptions • Maintain and troubleshoot hybrid and cross-cloud network connectivity (Transit Gateway, VPN, Direct Connect, GCP Cloud Interconnect) Cloud Engineering (Build) • Design and drive multi-cloud consolidation strategy (four clouds converging toward AWS-primary / GCP-secondary) • Architect landing zones, governance guardrails and account structures for AWS and GCP • Lead migration and modernization from VM-heavy workloads toward containers and serverless where applicable • Define Terraform / IaC state strategy, module boundaries and multi-team change coordination • Design observability, tagging and FinOps frameworks across AWS, GCP and Azure • Participate directly in architecture, planning and governance meetings with customer engineering and compliance teams REQUIRED TECHNICAL EXPERTISE AWS Governance, Organizations & Control Tower • Deep working knowledge of AWS Organizations, Service Control Policies (SCPs) and OU hierarchy / policy inheritance • Diagnosing cross-OU impact from SCP changes and nested-policy inheritance issues • AWS Control Tower guardrails, drift detection and remediation using AWS Config and configuration management tooling • Judgment to distinguish an approved manual exception (e.g., set during a prior P1) from a genuine control gap before remediating Multi-Cloud Networking & Connectivity (AWS GCP On-Prem) • Hub-and-spoke network design using AWS Transit Gateway and TGW attachments across a multi-account estate • Route-propagation troubleshooting, VPC Flow Logs and network observability for rapid fault isolation • Private AWS-to-GCP connectivity design: VPN and interconnect-style patterns for VPC-to-VPC traffic • AWS Direct Connect and GCP Cloud Interconnect for resilient, high-throughput on-prem connectivity • Working knowledge of Microsoft Entra ID for cross-platform identity and access integration Scientific / Enterprise Data & Storage Architecture • Designing data-lake ingestion patterns for high-volume instrument- or lab-generated data into AWS • Practical trade-off judgment between Amazon S3 / AWS Storage Gateway (archival, object-oriented, cost-efficient) and Amazon FSx (performance-sensitive, low-latency, file-system workloads) • Enabling downstream Python, ML and AI analysis workloads against cloud-resident data Infrastructure as Code & DevOps • Centralized, Git-based source control integrated with CI/CD and artifact management • Terraform state design at account / application / environment granularity (not monolithic state) • State-locking, workspace isolation and module-ownership patterns to prevent multi-team pipeline conflicts (e.g., infrastructure vs. security teams touching related resources) Observability, Tagging & FinOps • Building observability frameworks spanning metrics, persona-based dashboards, alerting and ITSM/collaboration integration (e.g., ServiceNow, Slack) • Correlating resources across AWS, GCP and Azure into a single operational view using a unified, enforced tagging strategy • Embedding tagging enforcement into CI/CD pipelines and remediating legacy untagged resources • Cost-optimization / FinOps practice using native tooling (AWS Cost Explorer, budgets, anomaly and forecast capabilities) and third-party platforms • Using tagging and observability signals to drive non-production shutdown policies, showback/chargeback and idle-resource identification CERTIFICATIONS & EXPERIENCE • 10+ years of hands-on AWS cloud management experience, including large-scale migrations and multi-account/multi-cloud consolidations • AWS Certified Solutions Architect – Associate or Professional (required) • Demonstrated multi-cloud experience with meaningful GCP exposure, including cross-cloud interconnectivity design • Working exposure to Microsoft Entra ID integration in a multi-cloud identity context • Proven track record supporting enterprise or regulated customers through AWS MSP, DevOps and cloud-optimization engagements • Hands-on practitioner — comfortable in the console, CLI and IaC, not solely in design/PowerPoint-level architecture INCIDENT & P1 TROUBLESHOOTING EXPECTATIONS This role requires genuine incident-response depth, not just familiarity with the concepts. The architect must be able to reason through ambiguous, multi-hop failure scenarios in real time — for example, tracing a broken pipeline back to an SCP change made in a different OU three days earlier, or isolating a silent route-propagation break in a Transit Gateway hub-and-spoke topology — using CloudTrail, AWS Config, VPC Flow Logs and related tooling, and driving remediation without introducing new risk. PREFERRED (NICE-TO-HAVE) • Experience in a regulated or life-sciences environment, including awareness of GxP / Part 11 change-control principles • Exposure to AI/ML enablement