Cloud Architect

We're seeking a Cloud Architect to join the CCoE and take the reins on the enterprise AWS landing zone, reference architectures, and self-service platform that power secure, compliant, cost-conscious infrastructure. You'll be the hands-on design authority, bringing security, networking, FinOps, and application teams into alignment to balance developer speed with resilience and financial discipline.

Responsibilities

• Take ownership of the AWS Organizations/Control Tower landing zone, covering OU hierarchy, baselines, and centralized logging
• Keep SCPs, Config rules, and conformance packs up to date while controlling break-glass access
• Bring identity management under one roof using IAM Identity Center with permission sets, federation, and ABAC
• Roll out and enforce a tagging taxonomy and tag policies to support cost tracking, ownership, automation, and reporting
• Operate account factory/self-service provisioning workflows with built-in tag enforcement and approval steps
• Oversee change management, catch configuration drift, and remediate issues at scale
• Create and publish AWS Well-Architected reference architectures, and lead Well-Architected Review sessions
• Architect VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and NGFW setups with Gateway Load Balancer inspection
• Establish workload landing patterns spanning IaaS, managed services, and serverless, clearly outlining the trade-offs of each
• Drive 7-R migration efforts and portfolio sequencing, lead design board meetings, and take charge of resilience, DR, and multi-region strategy
• Develop a self-service cloud/internal developer platform built on codified guardrails
• Establish Terraform module standards and registry strategy, define GitOps workflows, and manage golden-image and container platform patch/promotion pipelines

Requirements

• At least 2 years of experience working as a Software Architect
• Experience managing multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized logging
• Strong expertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspection
• Strong expertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module design
• Hands-on experience using governance tools such as SCPs, IAM Identity Center, and tagging strategy
• A background in writing enterprise reference architectures and acting as a cross-team design authority
• Excellent communication skills, with the ability to influence both engineers and executives
• Familiarity with AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vending
• Familiarity with IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patterns
• Familiarity with VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspection
• Familiarity with Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP)
• Familiarity with EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and Fargate
• Familiarity with CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets management
• English proficiency at a B2+ level or higher

Benefits

• International projects with top brands
• Work with global teams of highly skilled, diverse peers
• Healthcare benefits
• Employee financial programs
• Paid time off and sick leave
• Upskilling, reskilling and certification courses
• Unlimited access to the LinkedIn Learning library and 22,000+ courses
• Global career opportunities
• Volunteer and community involvement opportunities
• EPAM Employee Groups
• Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn