Senior AWS Landing Zone Architect/Engineer

We are seeking a Senior AWS Landing Zone Architect/Engineer to lead the design and implementation of a greenfield, well-architected, and governed AWS platform. Your mission is to bridge the gap between technology, operations, and security by establishing a secure foundation for cloud workloads. This is a highly consultative and technical role, requiring you to transition from high-level discovery workshops to hands-on implementation of a non-production environment. You will be responsible for ensuring that every architectural decision is justified, documented, and automated via a robust GitOps framework, setting the standard for regional expansion into Malaysia, Indonesia, and Singapore.

Key Responsibilities: Discovery & Architecture

• Stakeholder Facilitation: Lead discovery workshops to define requirements for organization structure, account strategy, security governance, and business alignment.
• Strategic Advisory: Advise on the AWS Shared Responsibility Model, security capabilities frameworks, and enterprise security principles to support a successful cloud transformation.
• Architecture Design: Develop the Target State Architecture for the Landing Zone, specifically covering account strategy, multi-region networking, and shared services.
• Minimum Security Baseline (MSB): Define the MSB covering identity and access management (IAM), detection, logging, monitoring, infrastructure security, data protection, and incident response.
• Decision Governance: Maintain a comprehensive Decision Register, documenting and justifying architectural trade-offs across technology and operations.
• Documentation: Deliver high-fidelity architectural diagrams and translate designs into actionable technical epics and user stories for implementation.

• Core Platform Deployment: Implement AWS Control Tower and AWS Organizations, configuring a scalable Organizational Unit (OU) structure and core accounts (Management, Network, Shared Services).
• Hub-and-Spoke Networking: Design and implement a centralized hub-and-spoke network architecture using AWS Transit Gateway and the AWS Network Orchestration for AWS Transit Gateway solution.
• Traffic Inspection: Configure north-south and east-west traffic inspection utilizing AWS Network Firewall and AWS Firewall Manager for up to five non-production accounts.
• IP & DNS Management: Manage CIDR allocation via Amazon VPC IP Address Manager (IPAM) and implement hybrid DNS solutions using Amazon Route 53 outbound resolver rules.
• Service Connectivity: Establish centralized VPC endpoint strategies and baseline routing to enable secure egress, ingress, and inspection capabilities.

• Advanced Policy Management: Define and implement up to five (5) Service Control Policies (SCPs), along with Resource Control Policies, Declarative policies, Amazon S3 policies, and Tag policies.
• Identity & Access: Implement SAML federation for IAM Identity Center and manage up to fifteen (15) complex permission sets.
• Automated Guardrails: Enable and automate the auto-enrollment of security services—including Amazon GuardDuty, AWS Security Hub, and Amazon Inspector—for all new accounts.
• Operational Security: Implement a robust "break-glass" access solution for AWS Control Tower and define operational guardrails based on AWS best practices.
• Financial Governance: Develop CloudFormation templates for AWS Budgets to provide email alerts based on customer-defined thresholds for five non-production accounts.

• Account Vending: Automate account provisioning by implementing a Terraform-based Account Vending Machine (AVM).
• Module Development: Design and implement five (5) centralized, reusable Terraform modules for core services (Amazon EKS, EC2, S3, RDS, and Auto Scaling Groups).
• GitOps & CI/CD: Establish effective GitOps workflows, including repository structures, Git branching strategies for infrastructure versioning, and CI/CD pipelines for module testing.
• Access Control: Define and implement granular access controls for infrastructure code to manage the boundary between system operations and application teams.
• Developer Enablement: Provide sample code and comprehensive documentation to demonstrate the usage and maintenance of the centralized module library.

Must-Have Core Skills

• Advanced IaC: Deep expertise in HashiCorp Terraform (module development, state management, and AVM).
• Orchestration & Networking: Proven experience with AWS Control Tower, AWS Organizations, and the AWS Network Orchestration for Transit Gateway solution.
• Security Governance: Hands-on experience with SCPs, Declarative policies, and IAM Identity Center (SAML).
• DevOps Pipelines: Strong command of GitOps, CI/CD pipeline construction, and version control branching strategies.

• AWS Security Services: Security Hub, GuardDuty, Inspector, and Network Firewall.
• AWS Management Tools: IPAM, Firewall Manager, AWS Budgets, and Route 53 Resolver.
• Architecture Frameworks: Thorough understanding of the AWS Well-Architected Framework and the Shared Responsibility Model.

• AWS Certified Solutions Architect – Professional or AWS Certified Security – Specialty.
• Experience in multi-region deployments specifically involving Indonesia and Singapore data residency requirements.
• Knowledge of Amazon EKS infrastructure baselining.