EPAM Systems

We are seeking a Cloud Architect to join the CCoE and own the enterprise AWS landing zone, reference architectures, and self-service platform that deliver secure, compliant, cost-aware infrastructure, acting as the hands-on design authority who aligns security, networking, FinOps, and application teams to balance developer velocity with resilience and financial accountability.

Responsibilities

• Own the AWS Organizations/Control Tower landing zone, including OU hierarchy, baselines, and centralized logging
• Maintain SCPs, Config rules, and conformance packs with controlled break-glass access
• Centralize identity via IAM Identity Center with permission sets, federation, and ABAC
• Enforce a tagging taxonomy and tag policies for cost, ownership, automation, and reporting
• Run account factory/self-service provisioning with enforced tags and approvals
• Manage change, detect drift, and remediate at scale
• Publish AWS Well-Architected reference architectures and lead Well-Architected Reviews
• Design VPC segmentation, Transit Gateway/Cloud WAN, hybrid links, and NGFW with Gateway Load Balancer inspection
• Define workload landing patterns across IaaS, managed services, and serverless with clear trade-offs
• Lead 7-R migrations and portfolio sequencing, chair design boards, and own resilience, DR, and multi-region strategy
• Build the self-service cloud/internal developer platform with codified guardrails
• Set Terraform module standards, registry strategy, and GitOps workflows, and run golden-image and container platform patch/promotion trains

Requirements

• At least 1 year of experience as a Software Architect
• Experience owning multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized logging
• Expertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspection
• Expertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module design
• Hands-on experience with governance tools such as SCPs, IAM Identity Center, and tagging strategy
• Background in authoring enterprise reference architectures and serving as cross-team design authority
• Exceptional communication skills with the ability to influence engineers and executives alike
• Knowledge of AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vending
• Knowledge of IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patterns
• Knowledge of VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspection
• Knowledge of Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP)
• Knowledge of EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and Fargate
• Knowledge of CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets management
• Proficiency in English at a B2+ level