AWS Platform Engineering Lead

At cb5, we are on a mission to find exceptional talent. Our tight-knit organization is led by five brothers, each technology leaders in their respective technical fields and driven to foster a culture of excellence through solidarity. We are seeking an AWS Platform Engineering Lead to stand up and own the AWS platform for a greenfield Department of Defense hybrid multi-cloud program. This team is on the front lines, shaping the systems that protect us from advanced threats. We are looking for highly motivated, results-oriented professionals who thrive on solving complex technical challenges in a dynamic environment.

The AWS Platform Engineering Lead is the technical authority for AWS on the program. You will design and build the AWS foundation, including the multi-account structure, landing zones, guardrails and service control policies, platform networking, and the platform services mission workloads run on. AWS is one of three platforms in this environment, alongside Azure and on-premises VMware Cloud Foundation, so much of the work is holding AWS to one program reference architecture rather than letting it become a separate design. The role is the direct engineering counterpart to the platform vendor and to the customer’s cloud architecture leadership, and it is hands-on. You will write the infrastructure code that stands the platform up, not only the design that describes it.

This is a full time position working onsite in either Colorado Springs, CO or Huntsville, AL, requiring less than 10% travel.

Key Responsibilities

The candidate will:

• Serve as the technical authority for AWS, owning the AWS platform architecture, engineering standards and design decisions.
• Design and build the AWS multi-account structure and landing zones, including Organizations, organizational units, account vending, and separation of platform from workload.
• Own AWS governance, including service control policies, permission boundaries, IAM role and policy standards, tagging, and cost management guardrails.
• Design AWS platform networking with the Network team, including VPC topology, Transit Gateway, Direct Connect and hybrid connectivity, DNS, and network security controls.
• Integrate AWS with the program identity architecture, including federation to the enterprise identity provider, IAM Identity Center, and privileged access for platform administration.
• Build the AWS platform through Infrastructure as Code using the program automation standards, and contribute AWS modules back to the shared library.
• Design platform security and compliance, including hardened baselines and images, key and secret management, logging and audit trails, and the evidence accreditation depends on.
• Design monitoring, resilience and recovery for the AWS platform, including telemetry, availability targets, and backup and recovery patterns.
• Serve as the engineering counterpart to the platform vendor and to customer cloud architecture leadership, and prepare AWS courses of action and design decisions for architecture review.
• Keep AWS aligned to the program reference architecture so identity, network, security and data patterns match what is delivered on Azure and on-premises.
• Support migration and application modernization by designing the target AWS landing zones and the platform capabilities each migration wave depends on.
• The successful candidate will:
  • Be a strong innovator in process improvement and system design.
  • Be able to quickly learn challenging concepts, decompose difficult service problems and provide resolution.
  • Be able to create and follow standard processes and clearly document results.
  • Effectively function as self-starter and identify risks, issues, and opportunities to leadership.
  • Have excellent presentation, oral and written skills to facilitate effective and efficient interchanges with senior customer management and customers.
• This role offers the opportunity to stand up the AWS foundation for a greenfield hybrid multi-cloud environment in support of defense, intelligence and enterprise modernization programs.

Qualifications

• Must have 10, or more, years of enterprise infrastructure or cloud engineering experience, with 6, or more, years focused on AWS architecture and engineering
• Must have 2, or more, years serving as the technical lead or design authority for an enterprise AWS environment
• Hands-on experience designing and building AWS multi-account environments, including Organizations, landing zones and service control policies.
• Experience with AWS platform networking, including VPC design, Transit Gateway, Direct Connect or equivalent hybrid connectivity, DNS and network security controls.
• Experience with AWS identity, including IAM roles and policies, cross-account access, and federation to an enterprise identity provider.
• Experience deploying AWS through Infrastructure as Code (Terraform or CloudFormation) and CI/CD pipelines.
• Experience with AWS platform security, including hardened baselines, key and secret management, logging and monitoring.
• Experience integrating AWS with on-premises infrastructure in a hybrid environment.
• Experience with AWS GovCloud or another sovereign, regulated or restricted cloud environment.
• Understanding of how AWS platform decisions affect identity, network, cybersecurity and migration teams.
• Excellent written and verbal communication skills, including presenting design decisions to senior government leadership and platform vendors.
• Must meet DoD 8570 certification requirements (e.g. Sec+) within 60 days of hire.
• Must have an active DoD Secret Security Clearance, or be eligible to obtain one.

Preferred Qualifications

• Have an active DoD Secret Security Clearance or Top-Secret Security Clearance with SCI eligibility
• Have a Bachelor’s degree (or higher) in Computer Science, Engineering, Information Systems, or related field
• Have 1, or more, AWS certifications (e.g, AWS Certified Solutions Architect – Professional, AWS Certified DevOps Engineer – Professional, AWS Certified Advanced Networking – Specialty).
• Have experience supporting Department of Defense (DoD) or Federal cloud initiatives.
• Have experience with DoD Impact Level environments and cloud accreditation requirements.
• Have experience with Amazon EKS, ECS or other AWS container and serverless platform services.
• Have experience designing multi-cloud environments that also include Azure.
• Have experience applying Zero Trust access control and enforcement within a cloud platform.
• Have experience working in an agile environment.

cb5 Solutions LLC is an Equal Opportunity Employer. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, genetic information, disability, veteran status, or any other protected characteristic.