AWS Cloud Platform Engineer

About the role

We are looking for a senior AWS platform engineer to lead the implementation and configuration of a self-service AWS sandbox capability (Innovation Sandbox on AWS) inside an established enterprise landing zone.

The environment is an existing AWS Control Tower organization with federated identity through Okta and IAM Identity Center, centralized logging into Splunk Cloud, and mandatory controls enforced by service control policy. The sandbox capability has to sit inside that organization rather than beside it, so every part of the build has to keep the existing baseline in force.

Must have

1. 7 to 10 years in AWS infrastructure, DevOps or cloud platform engineering, including at least 4 years in a multi-account environment.

2. Direct experience with Innovation Sandbox on AWS, AWS Nuke, cloud-nuke, or other account-vending or account-recycling automation.

3. Hands-on AWS Organizations: designing organizational units, authoring service control policies, account movement and delegated administration.

4. AWS Control Tower in production: landing zone, controls, Account Factory and drift detection.

5. IAM Identity Center: permission sets, groups, and SAML or SCIM federation from Okta or Entra ID.

6. Enough CloudWatch, CloudTrail, CloudWatch Logs Insights and S3 lifecycle configuration to stand up and prove centralized logging.

7. Cost Explorer, AWS Budgets and cost allocation tags, enough to configure sandbox spend into the existing allocation model.

8. Clear written English. Writing a runbook or change record that someone else can follow is a real part of this job.

Strongly preferred

1. Splunk with basic SPL in a centralized logging pattern.

2. AWS Certified Solutions Architect Professional, or DevOps Engineer Professional.

If anyone interested kindly drop your resume @[email removed]