AWS Enterprise Architect

AWS Architect

Required Skills & Experience• 8 or more years in cloud infrastructure or architecture, with at least 5 years focused on AWS at enterprise scale. Demonstrated experience consolidating a multi account AWS environment using AWS Organizations, Control Tower or a custom landing zone, including SCPs and centralized identity. Deep knowledge of AWS networking (VPC, Transit Gateway, PrivateLink, Direct Connect or VPN), IAM, KMS, CloudTrail, Config and Security Hub. Strong Terraform or CloudFormation skills and experience running them through CI/CD. Working experience with Amazon Bedrock, SageMaker and container or serverless hosting, and an understanding of how generative AI workloads differ in cost, data handling and risk. FinOps experience and the ability to explain a cloud bill to a business owner. A track record of writing clear architecture standards that engineering teams actually adopt, and strong communication with both engineers and executives.

Nice to Have Skills & ExperienceAWS Certified Solutions Architect Professional; Machine Learning, Security or Advanced Networking Specialty; experience with LLM observability, evaluation and guardrail tooling or agent frameworks; background in telecommunications or other regulated high availability environments.

Job DescriptionHotwire operates a number of AWS accounts that grew up team by team, with no organization level structure and no shared standards for identity, networking, tagging, logging or cost. At the same time, teams are beginning to build AI workloads and agents that need a secure, governed and cost controlled home on AWS. We are bringing in an experienced AWS architect to consolidate and standardize what exists and to design the AI platform foundation on which Hotwire teams will build. This is a hands on role: you will write the standards, build the reference implementations and lead the migration, reporting directly to the Senior Director of AI.

What you will deliver• An inventory of all Hotwire AWS accounts with ownership, workloads, spend and risk, and a target state and migration plan for consolidation under AWS Organizations. A landing zone (Control Tower or equivalent) with organizational units, service control policies, centralized logging, centralized identity through IAM Identity Center and an account vending process. Hotwire wide standards for IAM, network topology, encryption and key management, tagging, backup and resilience, delivered as infrastructure as code baselines (Terraform or CloudFormation). A FinOps model: tagging and cost allocation, budgets and alerts per account and workload, and rightsizing and savings plan recommendations. Migration of existing accounts and workloads into the new structure, sequenced with each owning team to minimize disruption. Governed access to Amazon Bedrock, SageMaker and third party model endpoints with private connectivity, identity based access, model allow lists, quotas and per team cost attribution. A reference architecture for hosting AI agents and applications on AWS, including compute pattern (ECS, EKS or Lambda), secrets management, observability and the guardrails every AI workload must carry: cost caps and token budgets, PII and secret redaction, full audit trail, and human approval gates. An AI landing zone with dedicated organizational units, accounts and policies so experimentation happens safely away from production, with secure connectivity to Hotwire's enterprise data platform. An architecture review process and written decision records so standards outlive the engagement, plus knowledge transfer to Hotwire engineers.

Milestones• 45 days: AWS account inventory complete with ownership, workloads, spend and risk; target organization design and migration plan presented and approved; quick wins identified for cost and security. 90 days: landing zone live with organizational units, SCPs, centralized logging and identity; first accounts enrolled; tagging and cost allocation standard published; Bedrock access pattern designed and under security review. 6 months: majority of accounts migrated under the standard; FinOps model operating with budgets and alerts; Bedrock access approved and serving at least one production AI workload; AI landing zone and agent hosting reference architecture adopted by at least one team; architecture review process and decision records in place.