Cloud Architect

We're seeking a Cloud Architect to join the CCoE and take the reins on the enterprise AWS landing zone, reference architectures, and self-service platform that power secure, compliant, cost-conscious infrastructure. You'll be the hands-on design authority, bringing security, networking, FinOps, and application teams into alignment to balance developer speed with resilience and financial discipline. Responsibilities Take ownership of the AWS Organizations/Control Tower landing zone, covering OU hierarchy, baselines, and centralized logging Keep SCPs, Config rules, and conformance packs up to date while controlling break-glass access Bring identity management under one roof using IAM Identity Center with permission sets, federation, and ABAC Roll out and enforce a tagging taxonomy and tag policies to support cost tracking, ownership, automation, and reporting Operate account factory/self-service provisioning workflows with built-in tag enforcement and approval steps Oversee change management, catch configuration drift, and remediate issues at scale Create and publish AWS Well-Architected reference architectures, and lead Well-Architected Review sessions Architect VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and NGFW setups with Gateway Load Balancer inspection Establish workload landing patterns spanning IaaS, managed services, and serverless, clearly outlining the trade-offs of each Drive 7-R migration efforts and portfolio sequencing, lead design board meetings, and take charge of resilience, DR, and multi-region strategy Develop a self-service cloud/internal developer platform built on codified guardrails Establish Terraform module standards and registry strategy, define GitOps workflows, and manage golden-image and container platform patch/promotion pipelines Requirements At least 2 years of experience working as a Software Architect Experience managing multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized logging Strong expertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspection Strong expertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module design Hands-on experience using governance tools such as SCPs, IAM Identity Center, and tagging strategy A background in writing enterprise reference architectures and acting as a cross-team design authority Excellent communication skills, with the ability to influence both engineers and executives Familiarity with AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vending Familiarity with IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patterns Familiarity with VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspection Familiarity with Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP) Familiarity with EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and Fargate Familiarity with CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets management English proficiency at a B2+ level or higher We offer International projects with top brands Work with global teams of highly skilled, diverse peers Healthcare benefits Employee financial programs Paid time off and sick leave Upskilling, reskilling and certification courses Unlimited access to the LinkedIn Learning library and 22,000+ courses Global career opportunities Volunteer and community involvement opportunities EPAM Employee Groups Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.

Take ownership of the AWS Organizations/Control Tower landing zone, covering OU hierarchy, baselines, and centralized logging Keep SCPs, Config rules, and conformance packs up to date while controlling break-glass access Bring identity management under one roof using IAM Identity Center with permission sets, federation, and ABAC Roll out and enforce a tagging taxonomy and tag policies to support cost tracking, ownership, automation, and reporting Operate account factory/self-service provisioning workflows with built-in tag enforcement and approval steps Oversee change management, catch configuration drift, and remediate issues at scale Create and publish AWS Well-Architected reference architectures, and lead Well-Architected Review sessions Architect VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and NGFW setups with Gateway Load Balancer inspection Establish workload landing patterns spanning IaaS, managed services, and serverless, clearly outlining the trade-offs of each Drive 7-R migration efforts and portfolio sequencing, lead design board meetings, and take charge of resilience, DR, and multi-region strategy Develop a self-service cloud/internal developer platform built on codified guardrails Establish Terraform module standards and registry strategy, define GitOps workflows, and manage golden-image and container platform patch/promotion pipelines

At least 2 years of experience working as a Software Architect Experience managing multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized logging Strong expertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspection Strong expertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module design Hands-on experience using governance tools such as SCPs, IAM Identity Center, and tagging strategy A background in writing enterprise reference architectures and acting as a cross-team design authority Excellent communication skills, with the ability to influence both engineers and executives Familiarity with AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vending Familiarity with IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patterns Familiarity with VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspection Familiarity with Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP) Familiarity with EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and Fargate Familiarity with CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets management English proficiency at a B2+ level or higher

International projects with top brands Work with global teams of highly skilled, diverse peers Healthcare benefits Employee financial programs Paid time off and sick leave Upskilling, reskilling and certification courses Unlimited access to the LinkedIn Learning library and 22,000+ courses Global career opportunities Volunteer and community involvement opportunities EPAM Employee Groups Award-winning culture recognized by Glassdoor, Newsweek and LinkedIn EPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.