Cloud Architect

Job Summary

Own the Cloud design, and governance of AWS-first cloud platforms, with strong focus on enterprise networking, hybrid connectivity, disaster recovery, and Infrastructure as Code. Drive secure, scalable, and cost-optimized architectures across multi-account AWS environments with supporting Azure integration.

Key Responsibilities

Cloud Architecture & Landing Zone

• Design and manage AWS Landing Zone (multi-account, OUs, account vending, SCPs) using Control Tower or custom frameworks
• Define centralized networking and shared services architecture
• Establish governance guardrails and baseline standards
• Design AWS DR strategies - Pilot Light, Warm Standby, Active-Active

AWS Networking (Core Focus)

• Architect and operate: VPC design (CIDR strategy, subnet segmentation, route tables, IGW/NAT, NACLs, SGs), Transit Gateway (TGW) with route propagation and segmentation, Private connectivity: Private Link, VPC Endpoints
• Design hybrid connectivity: Direct Connect (DX), Site-to-Site VPN (BGP-based)
• Define North-south and east-west traffic flows and Ingress/egress patterns and NAT strategies
• Design DNS architecture using Route53 (private/public zones, resolver endpoints)
• Define Hub-Spoke/hub-mesh topologies and architect multi-region connectivity

Cost Optimization

• Drive AWS & Azure cost optimization initiatives, including monitoring usage, implementing tagging standards, managing Savings Plans and Reserved Instances, and providing cost-saving recommendations based on FinOps model.

Cloud Operations & Reliability

• Define architecture and best practices for Kubernetes clusters on AWS (EKS) including node groups/node pools, cluster networking, autoscaling, upgrades, monitoring, and troubleshooting.
• Define and govern Azure-to-Amazon RDS migration strategies, including workload assessment, target architecture, cutover planning, and post-migration validation.
• Execute application and database migrations to AWS and Azure, supporting on-premises and cross-cloud migration initiatives.
• Monitor and optimize AWS and Azure environments, manage production incidents, perform RCA, and support SLA-driven operations.

Security & Governance

• Implement WAF, NGFW, DDoS protection, micro-segmentation
• Define and enforce guardrails (SCPs, policies, CSPM)

Qualifications

• 6-9 years of industry experience on AWS.
• Strong expertise in:
  • AWS Networking (VPC, TGW, DX, PrivateLink, Route53)
  • Terraform/CloudFormation
• Strong fundamentals on Routing (BGP), DNS, VPN, firewall architectures
• Certifications:
  • AWS: Solutions Architect Associate/Professional (preferred)
  • AWS Certified DevOps Engineer-Professional (nice-to-have)
  • HashiCorp Certified: Terraform Associate (nice-to-have)
  • AZ-104 (nice-to-have)