Cloud Architect

We are seeking a Cloud Architect to join the CCoE and own the enterprise AWS landing zone, reference architectures, and self-service platform that deliver secure, compliant, cost-aware infrastructure, acting as the hands-on design authority who aligns security, networking, FinOps, and application teams to balance developer velocity with resilience and financial accountability. Responsibilities Own the AWS Organizations/Control Tower landing zone, including OU hierarchy, baselines, and centralized logging Maintain SCPs, Config rules, and conformance packs with controlled break-glass access Centralize identity via IAM Identity Center with permission sets, federation, and ABAC Enforce a tagging taxonomy and tag policies for cost, ownership, automation, and reporting Run account factory/self-service provisioning with enforced tags and approvals Manage change, detect drift, and remediate at scale Publish AWS Well-Architected reference architectures and lead Well-Architected Reviews Design VPC segmentation, Transit Gateway/Cloud WAN, hybrid links, and NGFW with Gateway Load Balancer inspection Define workload landing patterns across IaaS, managed services, and serverless with clear trade-offs Lead 7-R migrations and portfolio sequencing, chair design boards, and own resilience, DR, and multi-region strategy Build the self-service cloud/internal developer platform with codified guardrails Set Terraform module standards, registry strategy, and GitOps workflows, and run golden-image and container platform patch/promotion trains Requirements At least 1 year of experience as a Software Architect Experience owning multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized logging Expertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspection Expertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module design Hands-on experience with governance tools such as SCPs, IAM Identity Center, and tagging strategy Background in authoring enterprise reference architectures and serving as cross-team design authority Exceptional communication skills with the ability to influence engineers and executives alike Knowledge of AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vending Knowledge of IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patterns Knowledge of VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspection Knowledge of Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP) Knowledge of EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and Fargate Knowledge of CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets management Proficiency in English at a B2+ level We offer International projects with top brands Work with global teams of highly skilled, diverse peers Healthcare benefits Employee financial programs Paid time off and sick leave Upskilling, reskilling and certification courses Unlimited access to the LinkedIn Learning library and 22,000+ courses Global career opportunities Volunteer and community involvement opportunities EPAM Employee Groups Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.

Own the AWS Organizations/Control Tower landing zone, including OU hierarchy, baselines, and centralized logging Maintain SCPs, Config rules, and conformance packs with controlled break-glass access Centralize identity via IAM Identity Center with permission sets, federation, and ABAC Enforce a tagging taxonomy and tag policies for cost, ownership, automation, and reporting Run account factory/self-service provisioning with enforced tags and approvals Manage change, detect drift, and remediate at scale Publish AWS Well-Architected reference architectures and lead Well-Architected Reviews Design VPC segmentation, Transit Gateway/Cloud WAN, hybrid links, and NGFW with Gateway Load Balancer inspection Define workload landing patterns across IaaS, managed services, and serverless with clear trade-offs Lead 7-R migrations and portfolio sequencing, chair design boards, and own resilience, DR, and multi-region strategy Build the self-service cloud/internal developer platform with codified guardrails Set Terraform module standards, registry strategy, and GitOps workflows, and run golden-image and container platform patch/promotion trains

At least 1 year of experience as a Software Architect Experience owning multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized logging Expertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspection Expertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module design Hands-on experience with governance tools such as SCPs, IAM Identity Center, and tagging strategy Background in authoring enterprise reference architectures and serving as cross-team design authority Exceptional communication skills with the ability to influence engineers and executives alike Knowledge of AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vending Knowledge of IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patterns Knowledge of VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspection Knowledge of Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP) Knowledge of EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and Fargate Knowledge of CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets management Proficiency in English at a B2+ level

International projects with top brands Work with global teams of highly skilled, diverse peers Healthcare benefits Employee financial programs Paid time off and sick leave Upskilling, reskilling and certification courses Unlimited access to the LinkedIn Learning library and 22,000+ courses Global career opportunities Volunteer and community involvement opportunities EPAM Employee Groups Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.