AWS Landing Zone Architect / Engineer

Job Description: Senior AWS Landing Zone Architect/Engineer Experience: 7 years (5 Years Minimum in AWS) Role Overview We are seeking a Senior AWS Landing Zone Architect/Engineer to lead the design and implementation of a greenfield, well-architected, and governed AWS platform. Your mission is to bridge the gap between technology, operations, and security by establishing a secure foundation for cloud workloads.

This is a highly consultative and technical role, requiring you to transition from high-level discovery workshops to hands-on implementation of a non-production environment. You will be responsible for ensuring that every architectural decision is justified, documented, and automated via a robust Git. Ops framework, setting the standard for regional expansion into Malaysia, Indonesia, and Singapore.

Key Responsibilities

Discovery & Architecture ● Stakeholder Facilitation: Lead discovery workshops to define requirements for organization structure, account strategy, security governance, and business alignment. ● Strategic Advisory: Advise on the AWS Shared Responsibility Model, security capabilities frameworks, and enterprise security principles to support a successful cloud transformation.

● Architecture Design: Develop the Target State Architecture for the Landing Zone, specifically covering account strategy, multi-region networking, and shared services. ● Minimum Security Baseline (MSB): Define the MSB covering identity and access management (IAM), detection, logging, monitoring, infrastructure security, data protection, and incident response.

● Decision Governance: Maintain a comprehensive Decision Register, documenting and justifying architectural trade-offs across technology and operations. ● Documentation: Deliver high-fidelity architectural diagrams and translate designs into actionable technical epics and user stories for implementation.

Key Responsibilities

Infrastructure & Network Implementation ● Core Platform Deployment: Implement AWS Control Tower and AWS Organizations, configuring a scalable Organizational Unit (OU) structure and core accounts (Management, Network, Shared Services). ● Hub-and-Spoke Networking: Design and implement a centralized hub-and-spoke network architecture using AWS Transit Gateway and the AWS Network Orchestration for AWS Transit Gateway Solution.

● Traffic Inspection: Configure north-south and east-west traffic inspection utilizing AWS Network Firewall andAWS Firewall Manager for up to five non-production accounts. ● IP & DNS Management: Manage CIDR allocation via Amazon VPC IP Address Manager (IPAM) and implement hybrid DNS solutions using Amazon Route 53 outbound resolver rules.

● Service Connectivity: Establish centralized VPC endpoint strategies and baseline routing to enable secure egress, ingress, and inspection capabilities.

Key Responsibilities

Security, Governance, and Operations ● Advanced Policy Management: Define and implement up to five (5) Service Control Policies (SCPs), along with Resource Control Policies, Declarative policies , Amazon S3 policies, and Tag policies. ● Identity & Access: Implement SAML federation for IAM Identity Center and manage up to fifteen (15) complex permission sets.

● Automated Guardrails: Enable and automate the auto-enrollment of security services—including Amazon Guard. Duty, AWS Security Hub, and Amazon Inspector—for all new accounts. ● Operational Security: Implement a robust "break-glass" access solution for AWS Control Tower and define operational guardrails based on AWS best practices.

● Financial Governance: Develop Cloud. Formation templates for AWS Budgets to provide email alerts based on customer-defined thresholds for five non-production accounts.

Key Responsibilities

Automation & Dev. Sec. Ops ● Account Vending: Automate account provisioning by implementing a Terraform-based Account Vending Machine (AVM). ● Module Development: Design and implement five (5) centralized, reusable Terraform modules for core services (Amazon EKS, EC2, S3, RDS, and Auto Scaling Groups). ● Git. Ops& CI/CD: Establish effective Git.

Ops workflows, including repository structures, Git branching strategies for infrastructure versioning and CI/CD pipelines for module testing. ● Access Control: Define and implement granular access controls for infrastructure code to manage the boundary between System operations and application teams. ● Developer Enablement: Provide sample code and comprehensive documentation to demonstrate the usage and maintenance of the centralized module library.

Requirements

Required Technical Skills & Qualifications Must-Have Core Skills ● Advanced IaC: Deep expertise in Hashi. Corp Terraform (module development, state management, and AVM). ● Orchestration & Networking: Proven experience with AWS Control Tower, AWS Organizations, and the AWS Network Orchestration for Transit Gateway solution.

● Security Governance: Hands-on experience with SCPs, Declarative policies, and IAM Identity Center (SAML). ● DevOps Pipelines: Strong command of Git. Ops, CI/CD pipeline construction, and version control branching strategies. Technical Domain Knowledge ● AWS Security Services: Security Hub, Guard. Duty, Inspector, and Network Firewall.

● AWS Management Tools: IPAM, Firewall Manager, AWS Budgets, and Route 53 Resolver. ● Architecture Frameworks: Thorough understanding of the AWS Well-Architected Framework and the Shared Responsibility Model. Nice-to-Have Skills ● AWS Certified Solutions Architect – Professional or AWS Certified Security – Specialty. ● Experience in multi-region deployments specifically involving Indonesia and Singapore data residency requirements.

● Knowledge of Amazon EKS infrastructure base lining.