Cloud Architect

EPAM Systems; Colombia; Remote; COP 120,000,000 - 180,000,000; Full time

Benefits offered by this job

Healthcare benefits

International projects

Upskilling and certifications

Job summary

EPAM Systems Inc. seeks a Cloud Architect to own the enterprise AWS landing zone, reference architectures and a self-service platform that balances developer velocity with security, cost awareness and resilience.

You will align security, networking, FinOps and application teams to deliver scalable cloud solutions. The role requires hands-on design authority across multi-account environments, governance automation, and a focus on Well-Architected practices while driving a cohesive modernization

Qualifications

• Experience owning multi-account AWS landing zones with Organizations, Control Tower, OU design and centralized logging.
• Hands-on governance with SCPs, IAM Identity Center, tagging strategy, and break-glass patterns.
• Background in authoring enterprise reference architectures and serving as cross-team design authority.

Responsibilities

• Own the AWS landing zone and reference architectures, ensuring secure, compliant and cost-aware infra.
• Maintain SCPs, Config rules, conformance packs and centralized logging.
• Centralize identity via IAM Identity Center with permission sets, federation and ABAC.
• Enforce tagging taxonomy and tag policies for cost, ownership, automation, and reporting.
• Run account factory/self-service provisioning with enforced tags and approvals.
• Publish Well-Architected reference architectures and lead Well-Architected Reviews.
• Design VPC segmentation, Transit Gateway/Cloud WAN, hybrid links, and NGFW with Gateway Load Balancer inspection.
• Define workload landing patterns across IaaS, managed services, and serverless.

Skills

Multi-account AWS landing zones

Terraform IaC

GitOps workflows

Networking (VPC segmentation)

Control Tower / Organizations

Security & IAM (SSO, ABAC)

Well-Architected reviews

Tools

Terraform Modules

Terraform Registry

GitOps tools (Atlantis)

CI/CD pipelines

Policy as Code (OPA, Sentinel)

Job description

We are seeking a Cloud Architect to join the CCoE and own the enterprise AWS landing zone, reference architectures, and self-service platform that deliver secure, compliant, cost-aware infrastructure, acting as the hands-on design authority who aligns security, networking, FinOps, and application teams to balance developer velocity with resilience and financial accountability.ResponsibilitiesOwn the AWS Organizations/Control Tower landing zone, including OU hierarchy, baselines, and centralized loggingMaintain SCPs, Config rules, and conformance packs with controlled break-glass accessCentralize identity via IAM Identity Center with permission sets, federation, and ABACEnforce a tagging taxonomy and tag policies for cost, ownership, automation, and reportingRun account factory/self-service provisioning with enforced tags and approvalsManage change, detect drift, and remediate at scalePublish AWS Well-Architected reference architectures and lead Well-Architected ReviewsDesign VPC segmentation, Transit Gateway/Cloud WAN, hybrid links, and NGFW with Gateway Load Balancer inspectionDefine workload landing patterns across IaaS, managed services, and serverless with clear trade-offsLead 7-R migrations and portfolio sequencing, chair design boards, and own resilience, DR, and multi-region strategyBuild the self-service cloud/internal developer platform with codified guardrailsSet Terraform module standards, registry strategy, and GitOps workflows, and run golden-image and container platform patch/promotion trainsRequirementsAt least 1 year of experience as a Software ArchitectExperience owning multi-account AWS landing zones with Organizations, Control Tower, OU/SCP strategy, and centralized loggingExpertise in networking, including VPC segmentation, Transit Gateway/Cloud WAN, hybrid connectivity, and centralized firewall inspectionExpertise in Terraform-based IaC, CI/CD pipelines, and GitOps workflows with reusable module designHands-on experience with governance tools such as SCPs, IAM Identity Center, and tagging strategyBackground in authoring enterprise reference architectures and serving as cross-team design authorityExceptional communication skills with the ability to influence engineers and executives alikeKnowledge of AWS Organizations, Control Tower, OU design, SCPs, Config conformance packs, and account factory/vendingKnowledge of IAM Identity Center (SSO), permission sets, federation, ABAC, role design, and break-glass patternsKnowledge of VPC design, Transit Gateway, Cloud WAN, Direct Connect/VPN, PrivateLink, Route 53, and NGFW with Gateway Load Balancer inspectionKnowledge of Terraform modules/registry, GitOps (Atlantis, Terraform Cloud), CI/CD pipelines, and policy-as-code (OPA, Sentinel, SCP)Knowledge of EC2, EKS, ECS, ECR, EC2 Image Builder, SSM Patch Manager, golden AMIs, Lambda, and FargateKnowledge of CSPM/CNAPP (Wiz, Prisma Cloud), GuardDuty, Security Hub, KMS, CIEM, and secrets managementProficiency in English at a B2+ levelWe offerInternational projects with top brandsWork with global teams of highly skilled, diverse peersHealthcare benefitsEmployee financial programsPaid time off and sick leaveUpskilling, reskilling and certification coursesUnlimited access to the LinkedIn Learning library and 22,000+ coursesGlobal career opportunitiesVolunteer and community involvement opportunitiesEPAM Employee GroupsAward-winning culture recognized by Glassdoor, Newsweek and LinkedInEPAM is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, age, sexual orientation, gender identity or expression, disability, protected veteran status, or any other characteristic protected by applicable law.